tcp_input.c revision 1.100
1 /* $NetBSD: tcp_input.c,v 1.100 1999/12/15 06:28:43 itojun Exp $ */ 2 3 /* 4 %%% portions-copyright-nrl-95 5 Portions of this software are Copyright 1995-1998 by Randall Atkinson, 6 Ronald Lee, Daniel McDonald, Bao Phan, and Chris Winters. All Rights 7 Reserved. All rights under this copyright have been assigned to the US 8 Naval Research Laboratory (NRL). The NRL Copyright Notice and License 9 Agreement Version 1.1 (January 17, 1995) applies to these portions of the 10 software. 11 You should have received a copy of the license with this software. If you 12 didn't get a copy, you may request one from <license (at) ipv6.nrl.navy.mil>. 13 14 */ 15 16 /* 17 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 18 * All rights reserved. 19 * 20 * Redistribution and use in source and binary forms, with or without 21 * modification, are permitted provided that the following conditions 22 * are met: 23 * 1. Redistributions of source code must retain the above copyright 24 * notice, this list of conditions and the following disclaimer. 25 * 2. Redistributions in binary form must reproduce the above copyright 26 * notice, this list of conditions and the following disclaimer in the 27 * documentation and/or other materials provided with the distribution. 28 * 3. Neither the name of the project nor the names of its contributors 29 * may be used to endorse or promote products derived from this software 30 * without specific prior written permission. 31 * 32 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 33 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 34 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 35 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 36 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 37 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 38 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 39 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 40 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 41 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 42 * SUCH DAMAGE. 43 */ 44 45 /*- 46 * Copyright (c) 1997, 1998, 1999 The NetBSD Foundation, Inc. 47 * All rights reserved. 48 * 49 * This code is derived from software contributed to The NetBSD Foundation 50 * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation 51 * Facility, NASA Ames Research Center. 52 * 53 * Redistribution and use in source and binary forms, with or without 54 * modification, are permitted provided that the following conditions 55 * are met: 56 * 1. Redistributions of source code must retain the above copyright 57 * notice, this list of conditions and the following disclaimer. 58 * 2. Redistributions in binary form must reproduce the above copyright 59 * notice, this list of conditions and the following disclaimer in the 60 * documentation and/or other materials provided with the distribution. 61 * 3. All advertising materials mentioning features or use of this software 62 * must display the following acknowledgement: 63 * This product includes software developed by the NetBSD 64 * Foundation, Inc. and its contributors. 65 * 4. Neither the name of The NetBSD Foundation nor the names of its 66 * contributors may be used to endorse or promote products derived 67 * from this software without specific prior written permission. 68 * 69 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 70 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 71 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 72 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 73 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 74 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 75 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 76 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 77 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 78 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 79 * POSSIBILITY OF SUCH DAMAGE. 80 */ 81 82 /* 83 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995 84 * The Regents of the University of California. All rights reserved. 85 * 86 * Redistribution and use in source and binary forms, with or without 87 * modification, are permitted provided that the following conditions 88 * are met: 89 * 1. Redistributions of source code must retain the above copyright 90 * notice, this list of conditions and the following disclaimer. 91 * 2. Redistributions in binary form must reproduce the above copyright 92 * notice, this list of conditions and the following disclaimer in the 93 * documentation and/or other materials provided with the distribution. 94 * 3. All advertising materials mentioning features or use of this software 95 * must display the following acknowledgement: 96 * This product includes software developed by the University of 97 * California, Berkeley and its contributors. 98 * 4. Neither the name of the University nor the names of its contributors 99 * may be used to endorse or promote products derived from this software 100 * without specific prior written permission. 101 * 102 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 103 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 104 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 105 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 106 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 107 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 108 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 109 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 110 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 111 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 112 * SUCH DAMAGE. 113 * 114 * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95 115 */ 116 117 /* 118 * TODO list for SYN cache stuff: 119 * 120 * Find room for a "state" field, which is needed to keep a 121 * compressed state for TIME_WAIT TCBs. It's been noted already 122 * that this is fairly important for very high-volume web and 123 * mail servers, which use a large number of short-lived 124 * connections. 125 */ 126 127 #include "opt_inet.h" 128 #include "opt_ipsec.h" 129 130 #include <sys/param.h> 131 #include <sys/systm.h> 132 #include <sys/malloc.h> 133 #include <sys/mbuf.h> 134 #include <sys/protosw.h> 135 #include <sys/socket.h> 136 #include <sys/socketvar.h> 137 #include <sys/errno.h> 138 #include <sys/syslog.h> 139 #include <sys/pool.h> 140 #include <sys/domain.h> 141 142 #include <net/if.h> 143 #include <net/route.h> 144 #include <net/if_types.h> 145 146 #include <netinet/in.h> 147 #include <netinet/in_systm.h> 148 #include <netinet/ip.h> 149 #include <netinet/in_pcb.h> 150 #include <netinet/ip_var.h> 151 152 #ifdef INET6 153 #ifndef INET 154 #include <netinet/in.h> 155 #endif 156 #include <netinet/ip6.h> 157 #include <netinet6/in6_pcb.h> 158 #include <netinet6/ip6_var.h> 159 #include <netinet6/in6_var.h> 160 #include <netinet/icmp6.h> 161 #include <netinet6/nd6.h> 162 #endif 163 164 #ifdef PULLDOWN_TEST 165 #ifndef INET6 166 /* always need ip6.h for IP6_EXTHDR_GET */ 167 #include <netinet/ip6.h> 168 #endif 169 #endif 170 171 #include <netinet/tcp.h> 172 #include <netinet/tcp_fsm.h> 173 #include <netinet/tcp_seq.h> 174 #include <netinet/tcp_timer.h> 175 #include <netinet/tcp_var.h> 176 #include <netinet/tcpip.h> 177 #include <netinet/tcp_debug.h> 178 179 #include <machine/stdarg.h> 180 181 #ifdef IPSEC 182 #include <netinet6/ipsec.h> 183 #include <netkey/key.h> 184 #include <netkey/key_debug.h> 185 #endif /*IPSEC*/ 186 #ifdef INET6 187 #include "faith.h" 188 #endif 189 190 int tcprexmtthresh = 3; 191 int tcp_log_refused; 192 193 #define TCP_PAWS_IDLE (24 * 24 * 60 * 60 * PR_SLOWHZ) 194 195 /* for modulo comparisons of timestamps */ 196 #define TSTMP_LT(a,b) ((int)((a)-(b)) < 0) 197 #define TSTMP_GEQ(a,b) ((int)((a)-(b)) >= 0) 198 199 /* 200 * Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint. 201 */ 202 #ifdef INET6 203 #define ND6_HINT(tp) \ 204 do { \ 205 if (tp && tp->t_in6pcb && tp->t_family == AF_INET6 \ 206 && tp->t_in6pcb->in6p_route.ro_rt) { \ 207 nd6_nud_hint(tp->t_in6pcb->in6p_route.ro_rt, NULL); \ 208 } \ 209 } while (0) 210 #else 211 #define ND6_HINT(tp) 212 #endif 213 214 /* 215 * Macro to compute ACK transmission behavior. Delay the ACK unless 216 * we have already delayed an ACK (must send an ACK every two segments). 217 * We also ACK immediately if we received a PUSH and the ACK-on-PUSH 218 * option is enabled. 219 */ 220 #define TCP_SETUP_ACK(tp, th) \ 221 do { \ 222 if ((tp)->t_flags & TF_DELACK || \ 223 (tcp_ack_on_push && (th)->th_flags & TH_PUSH)) \ 224 tp->t_flags |= TF_ACKNOW; \ 225 else \ 226 TCP_SET_DELACK(tp); \ 227 } while (0) 228 229 int 230 tcp_reass(tp, th, m, tlen) 231 register struct tcpcb *tp; 232 register struct tcphdr *th; 233 struct mbuf *m; 234 int *tlen; 235 { 236 register struct ipqent *p, *q, *nq, *tiqe = NULL; 237 struct socket *so = NULL; 238 int pkt_flags; 239 tcp_seq pkt_seq; 240 unsigned pkt_len; 241 u_long rcvpartdupbyte = 0; 242 u_long rcvoobyte; 243 244 if (tp->t_inpcb) 245 so = tp->t_inpcb->inp_socket; 246 #ifdef INET6 247 else if (tp->t_in6pcb) 248 so = tp->t_in6pcb->in6p_socket; 249 #endif 250 251 TCP_REASS_LOCK_CHECK(tp); 252 253 /* 254 * Call with th==0 after become established to 255 * force pre-ESTABLISHED data up to user socket. 256 */ 257 if (th == 0) 258 goto present; 259 260 rcvoobyte = *tlen; 261 /* 262 * Copy these to local variables because the tcpiphdr 263 * gets munged while we are collapsing mbufs. 264 */ 265 pkt_seq = th->th_seq; 266 pkt_len = *tlen; 267 pkt_flags = th->th_flags; 268 /* 269 * Find a segment which begins after this one does. 270 */ 271 for (p = NULL, q = tp->segq.lh_first; q != NULL; q = nq) { 272 nq = q->ipqe_q.le_next; 273 /* 274 * If the received segment is just right after this 275 * fragment, merge the two together and then check 276 * for further overlaps. 277 */ 278 if (q->ipqe_seq + q->ipqe_len == pkt_seq) { 279 #ifdef TCPREASS_DEBUG 280 printf("tcp_reass[%p]: concat %u:%u(%u) to %u:%u(%u)\n", 281 tp, pkt_seq, pkt_seq + pkt_len, pkt_len, 282 q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len); 283 #endif 284 pkt_len += q->ipqe_len; 285 pkt_flags |= q->ipqe_flags; 286 pkt_seq = q->ipqe_seq; 287 m_cat(q->ipqe_m, m); 288 m = q->ipqe_m; 289 goto free_ipqe; 290 } 291 /* 292 * If the received segment is completely past this 293 * fragment, we need to go the next fragment. 294 */ 295 if (SEQ_LT(q->ipqe_seq + q->ipqe_len, pkt_seq)) { 296 p = q; 297 continue; 298 } 299 /* 300 * If the fragment is past the received segment, 301 * it (or any following) can't be concatenated. 302 */ 303 if (SEQ_GT(q->ipqe_seq, pkt_seq + pkt_len)) 304 break; 305 /* 306 * We've received all the data in this segment before. 307 * mark it as a duplicate and return. 308 */ 309 if (SEQ_LEQ(q->ipqe_seq, pkt_seq) && 310 SEQ_GEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) { 311 tcpstat.tcps_rcvduppack++; 312 tcpstat.tcps_rcvdupbyte += pkt_len; 313 m_freem(m); 314 if (tiqe != NULL) 315 pool_put(&ipqent_pool, tiqe); 316 return (0); 317 } 318 /* 319 * Received segment completely overlaps this fragment 320 * so we drop the fragment (this keeps the temporal 321 * ordering of segments correct). 322 */ 323 if (SEQ_GEQ(q->ipqe_seq, pkt_seq) && 324 SEQ_LEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) { 325 rcvpartdupbyte += q->ipqe_len; 326 m_freem(q->ipqe_m); 327 goto free_ipqe; 328 } 329 /* 330 * RX'ed segment extends past the end of the 331 * fragment. Drop the overlapping bytes. Then 332 * merge the fragment and segment then treat as 333 * a longer received packet. 334 */ 335 if (SEQ_LT(q->ipqe_seq, pkt_seq) 336 && SEQ_GT(q->ipqe_seq + q->ipqe_len, pkt_seq)) { 337 int overlap = q->ipqe_seq + q->ipqe_len - pkt_seq; 338 #ifdef TCPREASS_DEBUG 339 printf("tcp_reass[%p]: trim starting %d bytes of %u:%u(%u)\n", 340 tp, overlap, 341 pkt_seq, pkt_seq + pkt_len, pkt_len); 342 #endif 343 m_adj(m, overlap); 344 rcvpartdupbyte += overlap; 345 m_cat(q->ipqe_m, m); 346 m = q->ipqe_m; 347 pkt_seq = q->ipqe_seq; 348 pkt_len += q->ipqe_len - overlap; 349 rcvoobyte -= overlap; 350 goto free_ipqe; 351 } 352 /* 353 * RX'ed segment extends past the front of the 354 * fragment. Drop the overlapping bytes on the 355 * received packet. The packet will then be 356 * contatentated with this fragment a bit later. 357 */ 358 if (SEQ_GT(q->ipqe_seq, pkt_seq) 359 && SEQ_LT(q->ipqe_seq, pkt_seq + pkt_len)) { 360 int overlap = pkt_seq + pkt_len - q->ipqe_seq; 361 #ifdef TCPREASS_DEBUG 362 printf("tcp_reass[%p]: trim trailing %d bytes of %u:%u(%u)\n", 363 tp, overlap, 364 pkt_seq, pkt_seq + pkt_len, pkt_len); 365 #endif 366 m_adj(m, -overlap); 367 pkt_len -= overlap; 368 rcvpartdupbyte += overlap; 369 rcvoobyte -= overlap; 370 } 371 /* 372 * If the received segment immediates precedes this 373 * fragment then tack the fragment onto this segment 374 * and reinsert the data. 375 */ 376 if (q->ipqe_seq == pkt_seq + pkt_len) { 377 #ifdef TCPREASS_DEBUG 378 printf("tcp_reass[%p]: append %u:%u(%u) to %u:%u(%u)\n", 379 tp, q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len, 380 pkt_seq, pkt_seq + pkt_len, pkt_len); 381 #endif 382 pkt_len += q->ipqe_len; 383 pkt_flags |= q->ipqe_flags; 384 m_cat(m, q->ipqe_m); 385 LIST_REMOVE(q, ipqe_q); 386 LIST_REMOVE(q, ipqe_timeq); 387 if (tiqe == NULL) { 388 tiqe = q; 389 } else { 390 pool_put(&ipqent_pool, q); 391 } 392 break; 393 } 394 /* 395 * If the fragment is before the segment, remember it. 396 * When this loop is terminated, p will contain the 397 * pointer to fragment that is right before the received 398 * segment. 399 */ 400 if (SEQ_LEQ(q->ipqe_seq, pkt_seq)) 401 p = q; 402 403 continue; 404 405 /* 406 * This is a common operation. It also will allow 407 * to save doing a malloc/free in most instances. 408 */ 409 free_ipqe: 410 LIST_REMOVE(q, ipqe_q); 411 LIST_REMOVE(q, ipqe_timeq); 412 if (tiqe == NULL) { 413 tiqe = q; 414 } else { 415 pool_put(&ipqent_pool, q); 416 } 417 } 418 419 /* 420 * Allocate a new queue entry since the received segment did not 421 * collapse onto any other out-of-order block; thus we are allocating 422 * a new block. If it had collapsed, tiqe would not be NULL and 423 * we would be reusing it. 424 * XXX If we can't, just drop the packet. XXX 425 */ 426 if (tiqe == NULL) { 427 tiqe = pool_get(&ipqent_pool, PR_NOWAIT); 428 if (tiqe == NULL) { 429 tcpstat.tcps_rcvmemdrop++; 430 m_freem(m); 431 return (0); 432 } 433 } 434 435 /* 436 * Update the counters. 437 */ 438 tcpstat.tcps_rcvoopack++; 439 tcpstat.tcps_rcvoobyte += rcvoobyte; 440 if (rcvpartdupbyte) { 441 tcpstat.tcps_rcvpartduppack++; 442 tcpstat.tcps_rcvpartdupbyte += rcvpartdupbyte; 443 } 444 445 /* 446 * Insert the new fragment queue entry into both queues. 447 */ 448 tiqe->ipqe_m = m; 449 tiqe->ipqe_seq = pkt_seq; 450 tiqe->ipqe_len = pkt_len; 451 tiqe->ipqe_flags = pkt_flags; 452 if (p == NULL) { 453 LIST_INSERT_HEAD(&tp->segq, tiqe, ipqe_q); 454 #ifdef TCPREASS_DEBUG 455 if (tiqe->ipqe_seq != tp->rcv_nxt) 456 printf("tcp_reass[%p]: insert %u:%u(%u) at front\n", 457 tp, pkt_seq, pkt_seq + pkt_len, pkt_len); 458 #endif 459 } else { 460 LIST_INSERT_AFTER(p, tiqe, ipqe_q); 461 #ifdef TCPREASS_DEBUG 462 printf("tcp_reass[%p]: insert %u:%u(%u) after %u:%u(%u)\n", 463 tp, pkt_seq, pkt_seq + pkt_len, pkt_len, 464 p->ipqe_seq, p->ipqe_seq + p->ipqe_len, p->ipqe_len); 465 #endif 466 } 467 468 LIST_INSERT_HEAD(&tp->timeq, tiqe, ipqe_timeq); 469 470 present: 471 /* 472 * Present data to user, advancing rcv_nxt through 473 * completed sequence space. 474 */ 475 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0) 476 return (0); 477 q = tp->segq.lh_first; 478 if (q == NULL || q->ipqe_seq != tp->rcv_nxt) 479 return (0); 480 if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_len) 481 return (0); 482 483 tp->rcv_nxt += q->ipqe_len; 484 pkt_flags = q->ipqe_flags & TH_FIN; 485 ND6_HINT(tp); 486 487 LIST_REMOVE(q, ipqe_q); 488 LIST_REMOVE(q, ipqe_timeq); 489 if (so->so_state & SS_CANTRCVMORE) 490 m_freem(q->ipqe_m); 491 else 492 sbappend(&so->so_rcv, q->ipqe_m); 493 pool_put(&ipqent_pool, q); 494 sorwakeup(so); 495 return (pkt_flags); 496 } 497 498 #if defined(INET6) && !defined(TCP6) 499 int 500 tcp6_input(mp, offp, proto) 501 struct mbuf **mp; 502 int *offp, proto; 503 { 504 struct mbuf *m = *mp; 505 506 #if defined(NFAITH) && 0 < NFAITH 507 if (m->m_pkthdr.rcvif) { 508 if (m->m_pkthdr.rcvif->if_type == IFT_FAITH) { 509 /* XXX send icmp6 host/port unreach? */ 510 m_freem(m); 511 return IPPROTO_DONE; 512 } 513 } 514 #endif 515 516 /* 517 * draft-itojun-ipv6-tcp-to-anycast 518 * better place to put this in? 519 */ 520 if (m->m_flags & M_ANYCAST6) { 521 struct ip6_hdr *ip6; 522 if (m->m_len < sizeof(struct ip6_hdr)) { 523 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) { 524 tcpstat.tcps_rcvshort++; 525 return IPPROTO_DONE; 526 } 527 } 528 ip6 = mtod(m, struct ip6_hdr *); 529 icmp6_error(m, ICMP6_DST_UNREACH, 530 ICMP6_DST_UNREACH_ADDR, 531 (caddr_t)&ip6->ip6_dst - (caddr_t)ip6); 532 return IPPROTO_DONE; 533 } 534 535 tcp_input(m, *offp, proto); 536 return IPPROTO_DONE; 537 } 538 #endif 539 540 /* 541 * TCP input routine, follows pages 65-76 of the 542 * protocol specification dated September, 1981 very closely. 543 */ 544 void 545 #if __STDC__ 546 tcp_input(struct mbuf *m, ...) 547 #else 548 tcp_input(m, va_alist) 549 register struct mbuf *m; 550 #endif 551 { 552 int proto; 553 register struct tcphdr *th; 554 struct ip *ip; 555 register struct inpcb *inp; 556 #ifdef INET6 557 struct ip6_hdr *ip6; 558 register struct in6pcb *in6p; 559 #endif 560 caddr_t optp = NULL; 561 int optlen = 0; 562 int len, tlen, toff, hdroptlen = 0; 563 register struct tcpcb *tp = 0; 564 register int tiflags; 565 struct socket *so = NULL; 566 int todrop, acked, ourfinisacked, needoutput = 0; 567 short ostate = 0; 568 int iss = 0; 569 u_long tiwin; 570 struct tcp_opt_info opti; 571 int off, iphlen; 572 va_list ap; 573 int af; /* af on the wire */ 574 struct mbuf *tcp_saveti = NULL; 575 576 va_start(ap, m); 577 toff = va_arg(ap, int); 578 proto = va_arg(ap, int); 579 va_end(ap); 580 581 tcpstat.tcps_rcvtotal++; 582 583 bzero(&opti, sizeof(opti)); 584 opti.ts_present = 0; 585 opti.maxseg = 0; 586 587 /* 588 * Get IP and TCP header together in first mbuf. 589 * Note: IP leaves IP header in first mbuf. 590 */ 591 ip = mtod(m, struct ip *); 592 #ifdef INET6 593 ip6 = NULL; 594 #endif 595 switch (ip->ip_v) { 596 case 4: 597 af = AF_INET; 598 iphlen = sizeof(struct ip); 599 #ifndef PULLDOWN_TEST 600 /* would like to get rid of this... */ 601 if (toff > sizeof (struct ip)) { 602 ip_stripoptions(m, (struct mbuf *)0); 603 toff = sizeof(struct ip); 604 } 605 if (m->m_len < toff + sizeof (struct tcphdr)) { 606 if ((m = m_pullup(m, toff + sizeof (struct tcphdr))) == 0) { 607 tcpstat.tcps_rcvshort++; 608 return; 609 } 610 } 611 ip = mtod(m, struct ip *); 612 th = (struct tcphdr *)(mtod(m, caddr_t) + toff); 613 #else 614 ip = mtod(m, struct ip *); 615 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff, 616 sizeof(struct tcphdr)); 617 if (th == NULL) { 618 tcpstat.tcps_rcvshort++; 619 return; 620 } 621 #endif 622 623 /* 624 * Checksum extended TCP header and data. 625 */ 626 len = ip->ip_len; 627 tlen = len - toff; 628 #ifndef PULLDOWN_TEST 629 { 630 struct ipovly *ipov; 631 ipov = (struct ipovly *)ip; 632 bzero(ipov->ih_x1, sizeof ipov->ih_x1); 633 ipov->ih_len = htons(tlen); 634 } 635 if (in_cksum(m, len) != 0) { 636 tcpstat.tcps_rcvbadsum++; 637 goto drop; 638 } 639 #else 640 if (in4_cksum(m, IPPROTO_TCP, toff, tlen) != 0) { 641 tcpstat.tcps_rcvbadsum++; 642 goto drop; 643 } 644 #endif 645 break; 646 #ifdef INET6 647 case 6: 648 ip = NULL; 649 iphlen = sizeof(struct ip6_hdr); 650 af = AF_INET6; 651 #ifndef PULLDOWN_TEST 652 if (m->m_len < toff + sizeof(struct tcphdr)) { 653 m = m_pullup(m, toff + sizeof(struct tcphdr)); /*XXX*/ 654 if (m == NULL) { 655 tcpstat.tcps_rcvshort++; 656 return; 657 } 658 } 659 ip6 = mtod(m, struct ip6_hdr *); 660 th = (struct tcphdr *)(mtod(m, caddr_t) + toff); 661 #else 662 ip6 = mtod(m, struct ip6_hdr *); 663 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff, 664 sizeof(struct tcphdr)); 665 if (th == NULL) { 666 tcpstat.tcps_rcvshort++; 667 return; 668 } 669 #endif 670 671 /* 672 * Checksum extended TCP header and data. 673 */ 674 len = m->m_pkthdr.len; 675 tlen = len - toff; 676 if (in6_cksum(m, IPPROTO_TCP, toff, tlen)) { 677 tcpstat.tcps_rcvbadsum++; 678 goto drop; 679 } 680 break; 681 #endif 682 default: 683 m_freem(m); 684 return; 685 } 686 687 /* 688 * Check that TCP offset makes sense, 689 * pull out TCP options and adjust length. XXX 690 */ 691 off = th->th_off << 2; 692 if (off < sizeof (struct tcphdr) || off > tlen) { 693 tcpstat.tcps_rcvbadoff++; 694 goto drop; 695 } 696 tlen -= off; 697 698 /* 699 * tcp_input() has been modified to use tlen to mean the TCP data 700 * length throughout the function. Other functions can use 701 * m->m_pkthdr.len as the basis for calculating the TCP data length. 702 * rja 703 */ 704 705 if (off > sizeof (struct tcphdr)) { 706 #ifndef PULLDOWN_TEST 707 if (m->m_len < toff + off) { 708 if ((m = m_pullup(m, toff + off)) == 0) { 709 tcpstat.tcps_rcvshort++; 710 return; 711 } 712 switch (af) { 713 case AF_INET: 714 ip = mtod(m, struct ip *); 715 break; 716 #ifdef INET6 717 case AF_INET6: 718 ip6 = mtod(m, struct ip6_hdr *); 719 break; 720 #endif 721 } 722 th = (struct tcphdr *)(mtod(m, caddr_t) + toff); 723 } 724 #else 725 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff, off); 726 if (th == NULL) { 727 tcpstat.tcps_rcvshort++; 728 return; 729 } 730 /* 731 * NOTE: ip/ip6 will not be affected by m_pulldown() 732 * (as they're before toff) and we don't need to update those. 733 */ 734 #endif 735 optlen = off - sizeof (struct tcphdr); 736 optp = ((caddr_t)th) + sizeof(struct tcphdr); 737 /* 738 * Do quick retrieval of timestamp options ("options 739 * prediction?"). If timestamp is the only option and it's 740 * formatted as recommended in RFC 1323 appendix A, we 741 * quickly get the values now and not bother calling 742 * tcp_dooptions(), etc. 743 */ 744 if ((optlen == TCPOLEN_TSTAMP_APPA || 745 (optlen > TCPOLEN_TSTAMP_APPA && 746 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) && 747 *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) && 748 (th->th_flags & TH_SYN) == 0) { 749 opti.ts_present = 1; 750 opti.ts_val = ntohl(*(u_int32_t *)(optp + 4)); 751 opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8)); 752 optp = NULL; /* we've parsed the options */ 753 } 754 } 755 tiflags = th->th_flags; 756 757 /* 758 * Convert TCP protocol specific fields to host format. 759 */ 760 NTOHL(th->th_seq); 761 NTOHL(th->th_ack); 762 NTOHS(th->th_win); 763 NTOHS(th->th_urp); 764 765 /* 766 * Locate pcb for segment. 767 */ 768 findpcb: 769 inp = NULL; 770 #ifdef INET6 771 in6p = NULL; 772 #endif 773 switch (af) { 774 case AF_INET: 775 inp = in_pcblookup_connect(&tcbtable, ip->ip_src, th->th_sport, 776 ip->ip_dst, th->th_dport); 777 if (inp == 0) { 778 ++tcpstat.tcps_pcbhashmiss; 779 inp = in_pcblookup_bind(&tcbtable, ip->ip_dst, th->th_dport); 780 } 781 #if defined(INET6) && !defined(TCP6) 782 if (inp == 0) { 783 struct in6_addr s, d; 784 785 /* mapped addr case */ 786 bzero(&s, sizeof(s)); 787 s.s6_addr16[5] = htons(0xffff); 788 bcopy(&ip->ip_src, &s.s6_addr32[3], sizeof(ip->ip_src)); 789 bzero(&d, sizeof(d)); 790 d.s6_addr16[5] = htons(0xffff); 791 bcopy(&ip->ip_dst, &d.s6_addr32[3], sizeof(ip->ip_dst)); 792 in6p = in6_pcblookup_connect(&tcb6, &s, th->th_sport, 793 &d, th->th_dport, 0); 794 if (in6p == 0) { 795 ++tcpstat.tcps_pcbhashmiss; 796 in6p = in6_pcblookup_bind(&tcb6, &d, 797 th->th_dport, 0); 798 } 799 } 800 #endif 801 #ifndef INET6 802 if (inp == 0) 803 #else 804 if (inp == 0 && in6p == 0) 805 #endif 806 { 807 ++tcpstat.tcps_noport; 808 if (tcp_log_refused && (tiflags & TH_SYN)) { 809 #ifndef INET6 810 char src[4*sizeof "123"]; 811 char dst[4*sizeof "123"]; 812 #else 813 char src[INET6_ADDRSTRLEN]; 814 char dst[INET6_ADDRSTRLEN]; 815 #endif 816 if (ip) { 817 strcpy(src, inet_ntoa(ip->ip_src)); 818 strcpy(dst, inet_ntoa(ip->ip_dst)); 819 } 820 #ifdef INET6 821 else if (ip6) { 822 strcpy(src, ip6_sprintf(&ip6->ip6_src)); 823 strcpy(dst, ip6_sprintf(&ip6->ip6_dst)); 824 } 825 #endif 826 else { 827 strcpy(src, "(unknown)"); 828 strcpy(dst, "(unknown)"); 829 } 830 log(LOG_INFO, 831 "Connection attempt to TCP %s:%d from %s:%d\n", 832 dst, ntohs(th->th_dport), 833 src, ntohs(th->th_sport)); 834 } 835 goto dropwithreset; 836 } 837 #ifdef IPSEC 838 if (inp && ipsec4_in_reject(m, inp)) { 839 ipsecstat.in_polvio++; 840 goto drop; 841 } 842 #ifdef INET6 843 else if (in6p && ipsec4_in_reject_so(m, in6p->in6p_socket)) { 844 ipsecstat.in_polvio++; 845 goto drop; 846 } 847 #endif 848 #endif /*IPSEC*/ 849 break; 850 #if defined(INET6) && !defined(TCP6) 851 case AF_INET6: 852 { 853 int faith; 854 855 #if defined(NFAITH) && NFAITH > 0 856 if (m->m_pkthdr.rcvif 857 && m->m_pkthdr.rcvif->if_type == IFT_FAITH) { 858 faith = 1; 859 } else 860 faith = 0; 861 #else 862 faith = 0; 863 #endif 864 in6p = in6_pcblookup_connect(&tcb6, &ip6->ip6_src, th->th_sport, 865 &ip6->ip6_dst, th->th_dport, faith); 866 if (in6p == NULL) { 867 ++tcpstat.tcps_pcbhashmiss; 868 in6p = in6_pcblookup_bind(&tcb6, &ip6->ip6_dst, 869 th->th_dport, faith); 870 } 871 if (in6p == NULL) { 872 ++tcpstat.tcps_noport; 873 goto dropwithreset; 874 } 875 #ifdef IPSEC 876 if (ipsec6_in_reject(m, in6p)) { 877 ipsec6stat.in_polvio++; 878 goto drop; 879 } 880 #endif /*IPSEC*/ 881 break; 882 } 883 #endif 884 } 885 886 /* 887 * If the state is CLOSED (i.e., TCB does not exist) then 888 * all data in the incoming segment is discarded. 889 * If the TCB exists but is in CLOSED state, it is embryonic, 890 * but should either do a listen or a connect soon. 891 */ 892 tp = NULL; 893 so = NULL; 894 if (inp) { 895 tp = intotcpcb(inp); 896 so = inp->inp_socket; 897 } 898 #ifdef INET6 899 else if (in6p) { 900 tp = in6totcpcb(in6p); 901 so = in6p->in6p_socket; 902 } 903 #endif 904 if (tp == 0) { 905 goto dropwithreset; 906 } 907 if (tp->t_state == TCPS_CLOSED) 908 goto drop; 909 910 /* Unscale the window into a 32-bit value. */ 911 if ((tiflags & TH_SYN) == 0) 912 tiwin = th->th_win << tp->snd_scale; 913 else 914 tiwin = th->th_win; 915 916 #ifdef INET6 917 /* save packet options if user wanted */ 918 if (in6p && (in6p->in6p_flags & IN6P_CONTROLOPTS)) { 919 if (in6p->in6p_options) { 920 m_freem(in6p->in6p_options); 921 in6p->in6p_options = 0; 922 } 923 ip6_savecontrol(in6p, &in6p->in6p_options, ip6, m); 924 } 925 #endif 926 927 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) { 928 union syn_cache_sa src; 929 union syn_cache_sa dst; 930 931 bzero(&src, sizeof(src)); 932 bzero(&dst, sizeof(dst)); 933 switch (af) { 934 case AF_INET: 935 src.sin.sin_len = sizeof(struct sockaddr_in); 936 src.sin.sin_family = AF_INET; 937 src.sin.sin_addr = ip->ip_src; 938 src.sin.sin_port = th->th_sport; 939 940 dst.sin.sin_len = sizeof(struct sockaddr_in); 941 dst.sin.sin_family = AF_INET; 942 dst.sin.sin_addr = ip->ip_dst; 943 dst.sin.sin_port = th->th_dport; 944 break; 945 #ifdef INET6 946 case AF_INET6: 947 src.sin6.sin6_len = sizeof(struct sockaddr_in6); 948 src.sin6.sin6_family = AF_INET6; 949 src.sin6.sin6_addr = ip6->ip6_src; 950 src.sin6.sin6_port = th->th_sport; 951 952 dst.sin6.sin6_len = sizeof(struct sockaddr_in6); 953 dst.sin6.sin6_family = AF_INET6; 954 dst.sin6.sin6_addr = ip6->ip6_dst; 955 dst.sin6.sin6_port = th->th_dport; 956 break; 957 #endif /* INET6 */ 958 default: 959 goto badsyn; /*sanity*/ 960 } 961 962 if (so->so_options & SO_DEBUG) { 963 ostate = tp->t_state; 964 tcp_saveti = m_copym(m, 0, iphlen, M_DONTWAIT); 965 if (M_TRAILINGSPACE(tcp_saveti) < sizeof(struct tcphdr)) { 966 m_freem(tcp_saveti); 967 tcp_saveti = NULL; 968 } else { 969 tcp_saveti->m_len += sizeof(struct tcphdr); 970 bcopy(th, mtod(tcp_saveti, caddr_t) + iphlen, 971 sizeof(struct tcphdr)); 972 } 973 if (tcp_saveti) { 974 /* 975 * need to recover version # field, which was 976 * overwritten on ip_cksum computation. 977 */ 978 struct ip *sip; 979 sip = mtod(tcp_saveti, struct ip *); 980 switch (af) { 981 case AF_INET: 982 sip->ip_v = 4; 983 break; 984 #ifdef INET6 985 case AF_INET6: 986 sip->ip_v = 6; 987 break; 988 #endif 989 } 990 } 991 } 992 if (so->so_options & SO_ACCEPTCONN) { 993 if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) { 994 if (tiflags & TH_RST) { 995 syn_cache_reset(&src.sa, &dst.sa, th); 996 } else if ((tiflags & (TH_ACK|TH_SYN)) == 997 (TH_ACK|TH_SYN)) { 998 /* 999 * Received a SYN,ACK. This should 1000 * never happen while we are in 1001 * LISTEN. Send an RST. 1002 */ 1003 goto badsyn; 1004 } else if (tiflags & TH_ACK) { 1005 so = syn_cache_get(&src.sa, &dst.sa, 1006 th, toff, tlen, so, m); 1007 if (so == NULL) { 1008 /* 1009 * We don't have a SYN for 1010 * this ACK; send an RST. 1011 */ 1012 goto badsyn; 1013 } else if (so == 1014 (struct socket *)(-1)) { 1015 /* 1016 * We were unable to create 1017 * the connection. If the 1018 * 3-way handshake was 1019 * completed, and RST has 1020 * been sent to the peer. 1021 * Since the mbuf might be 1022 * in use for the reply, 1023 * do not free it. 1024 */ 1025 m = NULL; 1026 } else { 1027 /* 1028 * We have created a 1029 * full-blown connection. 1030 */ 1031 tp = NULL; 1032 inp = NULL; 1033 #ifdef INET6 1034 in6p = NULL; 1035 #endif 1036 switch (so->so_proto->pr_domain->dom_family) { 1037 case AF_INET: 1038 inp = sotoinpcb(so); 1039 tp = intotcpcb(inp); 1040 break; 1041 #ifdef INET6 1042 case AF_INET6: 1043 in6p = sotoin6pcb(so); 1044 tp = in6totcpcb(in6p); 1045 break; 1046 #endif 1047 } 1048 if (tp == NULL) 1049 goto badsyn; /*XXX*/ 1050 tiwin <<= tp->snd_scale; 1051 goto after_listen; 1052 } 1053 } else { 1054 /* 1055 * None of RST, SYN or ACK was set. 1056 * This is an invalid packet for a 1057 * TCB in LISTEN state. Send a RST. 1058 */ 1059 goto badsyn; 1060 } 1061 } else { 1062 /* 1063 * Received a SYN. 1064 */ 1065 1066 /* 1067 * LISTEN socket received a SYN 1068 * from itself? This can't possibly 1069 * be valid; drop the packet. 1070 */ 1071 if (th->th_sport == th->th_dport) { 1072 int i; 1073 1074 switch (af) { 1075 case AF_INET: 1076 i = in_hosteq(ip->ip_src, ip->ip_dst); 1077 break; 1078 #ifdef INET6 1079 case AF_INET6: 1080 i = IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &ip6->ip6_dst); 1081 break; 1082 #endif 1083 default: 1084 i = 1; 1085 } 1086 if (i) { 1087 tcpstat.tcps_badsyn++; 1088 goto drop; 1089 } 1090 } 1091 1092 /* 1093 * SYN looks ok; create compressed TCP 1094 * state for it. 1095 */ 1096 if (so->so_qlen <= so->so_qlimit && 1097 syn_cache_add(&src.sa, &dst.sa, th, tlen, 1098 so, m, optp, optlen, &opti)) 1099 m = NULL; 1100 } 1101 goto drop; 1102 } 1103 } 1104 1105 after_listen: 1106 #ifdef DIAGNOSTIC 1107 /* 1108 * Should not happen now that all embryonic connections 1109 * are handled with compressed state. 1110 */ 1111 if (tp->t_state == TCPS_LISTEN) 1112 panic("tcp_input: TCPS_LISTEN"); 1113 #endif 1114 1115 /* 1116 * Segment received on connection. 1117 * Reset idle time and keep-alive timer. 1118 */ 1119 tp->t_idle = 0; 1120 if (TCPS_HAVEESTABLISHED(tp->t_state)) 1121 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle); 1122 1123 /* 1124 * Process options. 1125 */ 1126 if (optp) 1127 tcp_dooptions(tp, optp, optlen, th, &opti); 1128 1129 /* 1130 * Header prediction: check for the two common cases 1131 * of a uni-directional data xfer. If the packet has 1132 * no control flags, is in-sequence, the window didn't 1133 * change and we're not retransmitting, it's a 1134 * candidate. If the length is zero and the ack moved 1135 * forward, we're the sender side of the xfer. Just 1136 * free the data acked & wake any higher level process 1137 * that was blocked waiting for space. If the length 1138 * is non-zero and the ack didn't move, we're the 1139 * receiver side. If we're getting packets in-order 1140 * (the reassembly queue is empty), add the data to 1141 * the socket buffer and note that we need a delayed ack. 1142 */ 1143 if (tp->t_state == TCPS_ESTABLISHED && 1144 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK && 1145 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) && 1146 th->th_seq == tp->rcv_nxt && 1147 tiwin && tiwin == tp->snd_wnd && 1148 tp->snd_nxt == tp->snd_max) { 1149 1150 /* 1151 * If last ACK falls within this segment's sequence numbers, 1152 * record the timestamp. 1153 */ 1154 if (opti.ts_present && 1155 SEQ_LEQ(th->th_seq, tp->last_ack_sent) && 1156 SEQ_LT(tp->last_ack_sent, th->th_seq + tlen)) { 1157 tp->ts_recent_age = tcp_now; 1158 tp->ts_recent = opti.ts_val; 1159 } 1160 1161 if (tlen == 0) { 1162 if (SEQ_GT(th->th_ack, tp->snd_una) && 1163 SEQ_LEQ(th->th_ack, tp->snd_max) && 1164 tp->snd_cwnd >= tp->snd_wnd && 1165 tp->t_dupacks < tcprexmtthresh) { 1166 /* 1167 * this is a pure ack for outstanding data. 1168 */ 1169 ++tcpstat.tcps_predack; 1170 if (opti.ts_present && opti.ts_ecr) 1171 tcp_xmit_timer(tp, 1172 tcp_now - opti.ts_ecr + 1); 1173 else if (tp->t_rtt && 1174 SEQ_GT(th->th_ack, tp->t_rtseq)) 1175 tcp_xmit_timer(tp, tp->t_rtt); 1176 acked = th->th_ack - tp->snd_una; 1177 tcpstat.tcps_rcvackpack++; 1178 tcpstat.tcps_rcvackbyte += acked; 1179 ND6_HINT(tp); 1180 sbdrop(&so->so_snd, acked); 1181 /* 1182 * We want snd_recover to track snd_una to 1183 * avoid sequence wraparound problems for 1184 * very large transfers. 1185 */ 1186 tp->snd_una = tp->snd_recover = th->th_ack; 1187 m_freem(m); 1188 1189 /* 1190 * If all outstanding data are acked, stop 1191 * retransmit timer, otherwise restart timer 1192 * using current (possibly backed-off) value. 1193 * If process is waiting for space, 1194 * wakeup/selwakeup/signal. If data 1195 * are ready to send, let tcp_output 1196 * decide between more output or persist. 1197 */ 1198 if (tp->snd_una == tp->snd_max) 1199 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1200 else if (TCP_TIMER_ISARMED(tp, 1201 TCPT_PERSIST) == 0) 1202 TCP_TIMER_ARM(tp, TCPT_REXMT, 1203 tp->t_rxtcur); 1204 1205 sowwakeup(so); 1206 if (so->so_snd.sb_cc) 1207 (void) tcp_output(tp); 1208 if (tcp_saveti) 1209 m_freem(tcp_saveti); 1210 return; 1211 } 1212 } else if (th->th_ack == tp->snd_una && 1213 tp->segq.lh_first == NULL && 1214 tlen <= sbspace(&so->so_rcv)) { 1215 /* 1216 * this is a pure, in-sequence data packet 1217 * with nothing on the reassembly queue and 1218 * we have enough buffer space to take it. 1219 */ 1220 ++tcpstat.tcps_preddat; 1221 tp->rcv_nxt += tlen; 1222 tcpstat.tcps_rcvpack++; 1223 tcpstat.tcps_rcvbyte += tlen; 1224 ND6_HINT(tp); 1225 /* 1226 * Drop TCP, IP headers and TCP options then add data 1227 * to socket buffer. 1228 */ 1229 m_adj(m, toff + off); 1230 sbappend(&so->so_rcv, m); 1231 sorwakeup(so); 1232 TCP_SETUP_ACK(tp, th); 1233 if (tp->t_flags & TF_ACKNOW) 1234 (void) tcp_output(tp); 1235 if (tcp_saveti) 1236 m_freem(tcp_saveti); 1237 return; 1238 } 1239 } 1240 1241 /* 1242 * Compute mbuf offset to TCP data segment. 1243 */ 1244 hdroptlen = toff + off; 1245 1246 /* 1247 * Calculate amount of space in receive window, 1248 * and then do TCP input processing. 1249 * Receive window is amount of space in rcv queue, 1250 * but not less than advertised window. 1251 */ 1252 { int win; 1253 1254 win = sbspace(&so->so_rcv); 1255 if (win < 0) 1256 win = 0; 1257 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt)); 1258 } 1259 1260 switch (tp->t_state) { 1261 1262 /* 1263 * If the state is SYN_SENT: 1264 * if seg contains an ACK, but not for our SYN, drop the input. 1265 * if seg contains a RST, then drop the connection. 1266 * if seg does not contain SYN, then drop it. 1267 * Otherwise this is an acceptable SYN segment 1268 * initialize tp->rcv_nxt and tp->irs 1269 * if seg contains ack then advance tp->snd_una 1270 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state 1271 * arrange for segment to be acked (eventually) 1272 * continue processing rest of data/controls, beginning with URG 1273 */ 1274 case TCPS_SYN_SENT: 1275 if ((tiflags & TH_ACK) && 1276 (SEQ_LEQ(th->th_ack, tp->iss) || 1277 SEQ_GT(th->th_ack, tp->snd_max))) 1278 goto dropwithreset; 1279 if (tiflags & TH_RST) { 1280 if (tiflags & TH_ACK) 1281 tp = tcp_drop(tp, ECONNREFUSED); 1282 goto drop; 1283 } 1284 if ((tiflags & TH_SYN) == 0) 1285 goto drop; 1286 if (tiflags & TH_ACK) { 1287 tp->snd_una = tp->snd_recover = th->th_ack; 1288 if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 1289 tp->snd_nxt = tp->snd_una; 1290 } 1291 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1292 tp->irs = th->th_seq; 1293 tcp_rcvseqinit(tp); 1294 tp->t_flags |= TF_ACKNOW; 1295 tcp_mss_from_peer(tp, opti.maxseg); 1296 1297 /* 1298 * Initialize the initial congestion window. If we 1299 * had to retransmit the SYN, we must initialize cwnd 1300 * to 1 segment (i.e. the Loss Window). 1301 */ 1302 if (tp->t_flags & TF_SYN_REXMT) 1303 tp->snd_cwnd = tp->t_peermss; 1304 else 1305 tp->snd_cwnd = TCP_INITIAL_WINDOW(tcp_init_win, 1306 tp->t_peermss); 1307 1308 tcp_rmx_rtt(tp); 1309 if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) { 1310 tcpstat.tcps_connects++; 1311 soisconnected(so); 1312 tcp_established(tp); 1313 /* Do window scaling on this connection? */ 1314 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 1315 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 1316 tp->snd_scale = tp->requested_s_scale; 1317 tp->rcv_scale = tp->request_r_scale; 1318 } 1319 TCP_REASS_LOCK(tp); 1320 (void) tcp_reass(tp, NULL, (struct mbuf *)0, &tlen); 1321 TCP_REASS_UNLOCK(tp); 1322 /* 1323 * if we didn't have to retransmit the SYN, 1324 * use its rtt as our initial srtt & rtt var. 1325 */ 1326 if (tp->t_rtt) 1327 tcp_xmit_timer(tp, tp->t_rtt); 1328 } else 1329 tp->t_state = TCPS_SYN_RECEIVED; 1330 1331 /* 1332 * Advance th->th_seq to correspond to first data byte. 1333 * If data, trim to stay within window, 1334 * dropping FIN if necessary. 1335 */ 1336 th->th_seq++; 1337 if (tlen > tp->rcv_wnd) { 1338 todrop = tlen - tp->rcv_wnd; 1339 m_adj(m, -todrop); 1340 tlen = tp->rcv_wnd; 1341 tiflags &= ~TH_FIN; 1342 tcpstat.tcps_rcvpackafterwin++; 1343 tcpstat.tcps_rcvbyteafterwin += todrop; 1344 } 1345 tp->snd_wl1 = th->th_seq - 1; 1346 tp->rcv_up = th->th_seq; 1347 goto step6; 1348 1349 /* 1350 * If the state is SYN_RECEIVED: 1351 * If seg contains an ACK, but not for our SYN, drop the input 1352 * and generate an RST. See page 36, rfc793 1353 */ 1354 case TCPS_SYN_RECEIVED: 1355 if ((tiflags & TH_ACK) && 1356 (SEQ_LEQ(th->th_ack, tp->iss) || 1357 SEQ_GT(th->th_ack, tp->snd_max))) 1358 goto dropwithreset; 1359 break; 1360 } 1361 1362 /* 1363 * States other than LISTEN or SYN_SENT. 1364 * First check timestamp, if present. 1365 * Then check that at least some bytes of segment are within 1366 * receive window. If segment begins before rcv_nxt, 1367 * drop leading data (and SYN); if nothing left, just ack. 1368 * 1369 * RFC 1323 PAWS: If we have a timestamp reply on this segment 1370 * and it's less than ts_recent, drop it. 1371 */ 1372 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent && 1373 TSTMP_LT(opti.ts_val, tp->ts_recent)) { 1374 1375 /* Check to see if ts_recent is over 24 days old. */ 1376 if ((int)(tcp_now - tp->ts_recent_age) > TCP_PAWS_IDLE) { 1377 /* 1378 * Invalidate ts_recent. If this segment updates 1379 * ts_recent, the age will be reset later and ts_recent 1380 * will get a valid value. If it does not, setting 1381 * ts_recent to zero will at least satisfy the 1382 * requirement that zero be placed in the timestamp 1383 * echo reply when ts_recent isn't valid. The 1384 * age isn't reset until we get a valid ts_recent 1385 * because we don't want out-of-order segments to be 1386 * dropped when ts_recent is old. 1387 */ 1388 tp->ts_recent = 0; 1389 } else { 1390 tcpstat.tcps_rcvduppack++; 1391 tcpstat.tcps_rcvdupbyte += tlen; 1392 tcpstat.tcps_pawsdrop++; 1393 goto dropafterack; 1394 } 1395 } 1396 1397 todrop = tp->rcv_nxt - th->th_seq; 1398 if (todrop > 0) { 1399 if (tiflags & TH_SYN) { 1400 tiflags &= ~TH_SYN; 1401 th->th_seq++; 1402 if (th->th_urp > 1) 1403 th->th_urp--; 1404 else { 1405 tiflags &= ~TH_URG; 1406 th->th_urp = 0; 1407 } 1408 todrop--; 1409 } 1410 if (todrop > tlen || 1411 (todrop == tlen && (tiflags & TH_FIN) == 0)) { 1412 /* 1413 * Any valid FIN must be to the left of the window. 1414 * At this point the FIN must be a duplicate or 1415 * out of sequence; drop it. 1416 */ 1417 tiflags &= ~TH_FIN; 1418 /* 1419 * Send an ACK to resynchronize and drop any data. 1420 * But keep on processing for RST or ACK. 1421 */ 1422 tp->t_flags |= TF_ACKNOW; 1423 todrop = tlen; 1424 tcpstat.tcps_rcvdupbyte += todrop; 1425 tcpstat.tcps_rcvduppack++; 1426 } else { 1427 tcpstat.tcps_rcvpartduppack++; 1428 tcpstat.tcps_rcvpartdupbyte += todrop; 1429 } 1430 hdroptlen += todrop; /*drop from head afterwards*/ 1431 th->th_seq += todrop; 1432 tlen -= todrop; 1433 if (th->th_urp > todrop) 1434 th->th_urp -= todrop; 1435 else { 1436 tiflags &= ~TH_URG; 1437 th->th_urp = 0; 1438 } 1439 } 1440 1441 /* 1442 * If new data are received on a connection after the 1443 * user processes are gone, then RST the other end. 1444 */ 1445 if ((so->so_state & SS_NOFDREF) && 1446 tp->t_state > TCPS_CLOSE_WAIT && tlen) { 1447 tp = tcp_close(tp); 1448 tcpstat.tcps_rcvafterclose++; 1449 goto dropwithreset; 1450 } 1451 1452 /* 1453 * If segment ends after window, drop trailing data 1454 * (and PUSH and FIN); if nothing left, just ACK. 1455 */ 1456 todrop = (th->th_seq + tlen) - (tp->rcv_nxt+tp->rcv_wnd); 1457 if (todrop > 0) { 1458 tcpstat.tcps_rcvpackafterwin++; 1459 if (todrop >= tlen) { 1460 tcpstat.tcps_rcvbyteafterwin += tlen; 1461 /* 1462 * If a new connection request is received 1463 * while in TIME_WAIT, drop the old connection 1464 * and start over if the sequence numbers 1465 * are above the previous ones. 1466 */ 1467 if (tiflags & TH_SYN && 1468 tp->t_state == TCPS_TIME_WAIT && 1469 SEQ_GT(th->th_seq, tp->rcv_nxt)) { 1470 iss = tcp_new_iss(tp, sizeof(struct tcpcb), 1471 tp->snd_nxt); 1472 tp = tcp_close(tp); 1473 goto findpcb; 1474 } 1475 /* 1476 * If window is closed can only take segments at 1477 * window edge, and have to drop data and PUSH from 1478 * incoming segments. Continue processing, but 1479 * remember to ack. Otherwise, drop segment 1480 * and ack. 1481 */ 1482 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) { 1483 tp->t_flags |= TF_ACKNOW; 1484 tcpstat.tcps_rcvwinprobe++; 1485 } else 1486 goto dropafterack; 1487 } else 1488 tcpstat.tcps_rcvbyteafterwin += todrop; 1489 m_adj(m, -todrop); 1490 tlen -= todrop; 1491 tiflags &= ~(TH_PUSH|TH_FIN); 1492 } 1493 1494 /* 1495 * If last ACK falls within this segment's sequence numbers, 1496 * and the timestamp is newer, record it. 1497 */ 1498 if (opti.ts_present && TSTMP_GEQ(opti.ts_val, tp->ts_recent) && 1499 SEQ_LEQ(th->th_seq, tp->last_ack_sent) && 1500 SEQ_LT(tp->last_ack_sent, th->th_seq + tlen + 1501 ((tiflags & (TH_SYN|TH_FIN)) != 0))) { 1502 tp->ts_recent_age = tcp_now; 1503 tp->ts_recent = opti.ts_val; 1504 } 1505 1506 /* 1507 * If the RST bit is set examine the state: 1508 * SYN_RECEIVED STATE: 1509 * If passive open, return to LISTEN state. 1510 * If active open, inform user that connection was refused. 1511 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES: 1512 * Inform user that connection was reset, and close tcb. 1513 * CLOSING, LAST_ACK, TIME_WAIT STATES 1514 * Close the tcb. 1515 */ 1516 if (tiflags&TH_RST) switch (tp->t_state) { 1517 1518 case TCPS_SYN_RECEIVED: 1519 so->so_error = ECONNREFUSED; 1520 goto close; 1521 1522 case TCPS_ESTABLISHED: 1523 case TCPS_FIN_WAIT_1: 1524 case TCPS_FIN_WAIT_2: 1525 case TCPS_CLOSE_WAIT: 1526 so->so_error = ECONNRESET; 1527 close: 1528 tp->t_state = TCPS_CLOSED; 1529 tcpstat.tcps_drops++; 1530 tp = tcp_close(tp); 1531 goto drop; 1532 1533 case TCPS_CLOSING: 1534 case TCPS_LAST_ACK: 1535 case TCPS_TIME_WAIT: 1536 tp = tcp_close(tp); 1537 goto drop; 1538 } 1539 1540 /* 1541 * If a SYN is in the window, then this is an 1542 * error and we send an RST and drop the connection. 1543 */ 1544 if (tiflags & TH_SYN) { 1545 tp = tcp_drop(tp, ECONNRESET); 1546 goto dropwithreset; 1547 } 1548 1549 /* 1550 * If the ACK bit is off we drop the segment and return. 1551 */ 1552 if ((tiflags & TH_ACK) == 0) { 1553 if (tp->t_flags & TF_ACKNOW) 1554 goto dropafterack; 1555 else 1556 goto drop; 1557 } 1558 1559 /* 1560 * Ack processing. 1561 */ 1562 switch (tp->t_state) { 1563 1564 /* 1565 * In SYN_RECEIVED state if the ack ACKs our SYN then enter 1566 * ESTABLISHED state and continue processing, otherwise 1567 * send an RST. 1568 */ 1569 case TCPS_SYN_RECEIVED: 1570 if (SEQ_GT(tp->snd_una, th->th_ack) || 1571 SEQ_GT(th->th_ack, tp->snd_max)) 1572 goto dropwithreset; 1573 tcpstat.tcps_connects++; 1574 soisconnected(so); 1575 tcp_established(tp); 1576 /* Do window scaling? */ 1577 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 1578 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 1579 tp->snd_scale = tp->requested_s_scale; 1580 tp->rcv_scale = tp->request_r_scale; 1581 } 1582 TCP_REASS_LOCK(tp); 1583 (void) tcp_reass(tp, NULL, (struct mbuf *)0, &tlen); 1584 TCP_REASS_UNLOCK(tp); 1585 tp->snd_wl1 = th->th_seq - 1; 1586 /* fall into ... */ 1587 1588 /* 1589 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range 1590 * ACKs. If the ack is in the range 1591 * tp->snd_una < th->th_ack <= tp->snd_max 1592 * then advance tp->snd_una to th->th_ack and drop 1593 * data from the retransmission queue. If this ACK reflects 1594 * more up to date window information we update our window information. 1595 */ 1596 case TCPS_ESTABLISHED: 1597 case TCPS_FIN_WAIT_1: 1598 case TCPS_FIN_WAIT_2: 1599 case TCPS_CLOSE_WAIT: 1600 case TCPS_CLOSING: 1601 case TCPS_LAST_ACK: 1602 case TCPS_TIME_WAIT: 1603 1604 if (SEQ_LEQ(th->th_ack, tp->snd_una)) { 1605 if (tlen == 0 && tiwin == tp->snd_wnd) { 1606 tcpstat.tcps_rcvdupack++; 1607 /* 1608 * If we have outstanding data (other than 1609 * a window probe), this is a completely 1610 * duplicate ack (ie, window info didn't 1611 * change), the ack is the biggest we've 1612 * seen and we've seen exactly our rexmt 1613 * threshhold of them, assume a packet 1614 * has been dropped and retransmit it. 1615 * Kludge snd_nxt & the congestion 1616 * window so we send only this one 1617 * packet. 1618 * 1619 * We know we're losing at the current 1620 * window size so do congestion avoidance 1621 * (set ssthresh to half the current window 1622 * and pull our congestion window back to 1623 * the new ssthresh). 1624 * 1625 * Dup acks mean that packets have left the 1626 * network (they're now cached at the receiver) 1627 * so bump cwnd by the amount in the receiver 1628 * to keep a constant cwnd packets in the 1629 * network. 1630 */ 1631 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 || 1632 th->th_ack != tp->snd_una) 1633 tp->t_dupacks = 0; 1634 else if (++tp->t_dupacks == tcprexmtthresh) { 1635 tcp_seq onxt = tp->snd_nxt; 1636 u_int win = 1637 min(tp->snd_wnd, tp->snd_cwnd) / 1638 2 / tp->t_segsz; 1639 if (tcp_do_newreno && SEQ_LT(th->th_ack, 1640 tp->snd_recover)) { 1641 /* 1642 * False fast retransmit after 1643 * timeout. Do not cut window. 1644 */ 1645 tp->snd_cwnd += tp->t_segsz; 1646 tp->t_dupacks = 0; 1647 (void) tcp_output(tp); 1648 goto drop; 1649 } 1650 1651 if (win < 2) 1652 win = 2; 1653 tp->snd_ssthresh = win * tp->t_segsz; 1654 tp->snd_recover = tp->snd_max; 1655 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1656 tp->t_rtt = 0; 1657 tp->snd_nxt = th->th_ack; 1658 tp->snd_cwnd = tp->t_segsz; 1659 (void) tcp_output(tp); 1660 tp->snd_cwnd = tp->snd_ssthresh + 1661 tp->t_segsz * tp->t_dupacks; 1662 if (SEQ_GT(onxt, tp->snd_nxt)) 1663 tp->snd_nxt = onxt; 1664 goto drop; 1665 } else if (tp->t_dupacks > tcprexmtthresh) { 1666 tp->snd_cwnd += tp->t_segsz; 1667 (void) tcp_output(tp); 1668 goto drop; 1669 } 1670 } else 1671 tp->t_dupacks = 0; 1672 break; 1673 } 1674 /* 1675 * If the congestion window was inflated to account 1676 * for the other side's cached packets, retract it. 1677 */ 1678 if (tcp_do_newreno == 0) { 1679 if (tp->t_dupacks >= tcprexmtthresh && 1680 tp->snd_cwnd > tp->snd_ssthresh) 1681 tp->snd_cwnd = tp->snd_ssthresh; 1682 tp->t_dupacks = 0; 1683 } else if (tp->t_dupacks >= tcprexmtthresh && 1684 tcp_newreno(tp, th) == 0) { 1685 tp->snd_cwnd = tp->snd_ssthresh; 1686 /* 1687 * Window inflation should have left us with approx. 1688 * snd_ssthresh outstanding data. But in case we 1689 * would be inclined to send a burst, better to do 1690 * it via the slow start mechanism. 1691 */ 1692 if (SEQ_SUB(tp->snd_max, th->th_ack) < tp->snd_ssthresh) 1693 tp->snd_cwnd = SEQ_SUB(tp->snd_max, th->th_ack) 1694 + tp->t_segsz; 1695 tp->t_dupacks = 0; 1696 } 1697 if (SEQ_GT(th->th_ack, tp->snd_max)) { 1698 tcpstat.tcps_rcvacktoomuch++; 1699 goto dropafterack; 1700 } 1701 acked = th->th_ack - tp->snd_una; 1702 tcpstat.tcps_rcvackpack++; 1703 tcpstat.tcps_rcvackbyte += acked; 1704 1705 /* 1706 * If we have a timestamp reply, update smoothed 1707 * round trip time. If no timestamp is present but 1708 * transmit timer is running and timed sequence 1709 * number was acked, update smoothed round trip time. 1710 * Since we now have an rtt measurement, cancel the 1711 * timer backoff (cf., Phil Karn's retransmit alg.). 1712 * Recompute the initial retransmit timer. 1713 */ 1714 if (opti.ts_present && opti.ts_ecr) 1715 tcp_xmit_timer(tp, tcp_now - opti.ts_ecr + 1); 1716 else if (tp->t_rtt && SEQ_GT(th->th_ack, tp->t_rtseq)) 1717 tcp_xmit_timer(tp,tp->t_rtt); 1718 1719 /* 1720 * If all outstanding data is acked, stop retransmit 1721 * timer and remember to restart (more output or persist). 1722 * If there is more data to be acked, restart retransmit 1723 * timer, using current (possibly backed-off) value. 1724 */ 1725 if (th->th_ack == tp->snd_max) { 1726 TCP_TIMER_DISARM(tp, TCPT_REXMT); 1727 needoutput = 1; 1728 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) 1729 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 1730 /* 1731 * When new data is acked, open the congestion window. 1732 * If the window gives us less than ssthresh packets 1733 * in flight, open exponentially (segsz per packet). 1734 * Otherwise open linearly: segsz per window 1735 * (segsz^2 / cwnd per packet), plus a constant 1736 * fraction of a packet (segsz/8) to help larger windows 1737 * open quickly enough. 1738 */ 1739 { 1740 register u_int cw = tp->snd_cwnd; 1741 register u_int incr = tp->t_segsz; 1742 1743 if (cw > tp->snd_ssthresh) 1744 incr = incr * incr / cw; 1745 if (tcp_do_newreno == 0 || SEQ_GEQ(th->th_ack, tp->snd_recover)) 1746 tp->snd_cwnd = min(cw + incr, 1747 TCP_MAXWIN << tp->snd_scale); 1748 } 1749 ND6_HINT(tp); 1750 if (acked > so->so_snd.sb_cc) { 1751 tp->snd_wnd -= so->so_snd.sb_cc; 1752 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc); 1753 ourfinisacked = 1; 1754 } else { 1755 sbdrop(&so->so_snd, acked); 1756 tp->snd_wnd -= acked; 1757 ourfinisacked = 0; 1758 } 1759 sowwakeup(so); 1760 /* 1761 * We want snd_recover to track snd_una to 1762 * avoid sequence wraparound problems for 1763 * very large transfers. 1764 */ 1765 tp->snd_una = tp->snd_recover = th->th_ack; 1766 if (SEQ_LT(tp->snd_nxt, tp->snd_una)) 1767 tp->snd_nxt = tp->snd_una; 1768 1769 switch (tp->t_state) { 1770 1771 /* 1772 * In FIN_WAIT_1 STATE in addition to the processing 1773 * for the ESTABLISHED state if our FIN is now acknowledged 1774 * then enter FIN_WAIT_2. 1775 */ 1776 case TCPS_FIN_WAIT_1: 1777 if (ourfinisacked) { 1778 /* 1779 * If we can't receive any more 1780 * data, then closing user can proceed. 1781 * Starting the timer is contrary to the 1782 * specification, but if we don't get a FIN 1783 * we'll hang forever. 1784 */ 1785 if (so->so_state & SS_CANTRCVMORE) { 1786 soisdisconnected(so); 1787 if (tcp_maxidle > 0) 1788 TCP_TIMER_ARM(tp, TCPT_2MSL, 1789 tcp_maxidle); 1790 } 1791 tp->t_state = TCPS_FIN_WAIT_2; 1792 } 1793 break; 1794 1795 /* 1796 * In CLOSING STATE in addition to the processing for 1797 * the ESTABLISHED state if the ACK acknowledges our FIN 1798 * then enter the TIME-WAIT state, otherwise ignore 1799 * the segment. 1800 */ 1801 case TCPS_CLOSING: 1802 if (ourfinisacked) { 1803 tp->t_state = TCPS_TIME_WAIT; 1804 tcp_canceltimers(tp); 1805 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1806 soisdisconnected(so); 1807 } 1808 break; 1809 1810 /* 1811 * In LAST_ACK, we may still be waiting for data to drain 1812 * and/or to be acked, as well as for the ack of our FIN. 1813 * If our FIN is now acknowledged, delete the TCB, 1814 * enter the closed state and return. 1815 */ 1816 case TCPS_LAST_ACK: 1817 if (ourfinisacked) { 1818 tp = tcp_close(tp); 1819 goto drop; 1820 } 1821 break; 1822 1823 /* 1824 * In TIME_WAIT state the only thing that should arrive 1825 * is a retransmission of the remote FIN. Acknowledge 1826 * it and restart the finack timer. 1827 */ 1828 case TCPS_TIME_WAIT: 1829 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 1830 goto dropafterack; 1831 } 1832 } 1833 1834 step6: 1835 /* 1836 * Update window information. 1837 * Don't look at window if no ACK: TAC's send garbage on first SYN. 1838 */ 1839 if ((tiflags & TH_ACK) && (SEQ_LT(tp->snd_wl1, th->th_seq) || 1840 (tp->snd_wl1 == th->th_seq && SEQ_LT(tp->snd_wl2, th->th_ack)) || 1841 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))) { 1842 /* keep track of pure window updates */ 1843 if (tlen == 0 && 1844 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd) 1845 tcpstat.tcps_rcvwinupd++; 1846 tp->snd_wnd = tiwin; 1847 tp->snd_wl1 = th->th_seq; 1848 tp->snd_wl2 = th->th_ack; 1849 if (tp->snd_wnd > tp->max_sndwnd) 1850 tp->max_sndwnd = tp->snd_wnd; 1851 needoutput = 1; 1852 } 1853 1854 /* 1855 * Process segments with URG. 1856 */ 1857 if ((tiflags & TH_URG) && th->th_urp && 1858 TCPS_HAVERCVDFIN(tp->t_state) == 0) { 1859 /* 1860 * This is a kludge, but if we receive and accept 1861 * random urgent pointers, we'll crash in 1862 * soreceive. It's hard to imagine someone 1863 * actually wanting to send this much urgent data. 1864 */ 1865 if (th->th_urp + so->so_rcv.sb_cc > sb_max) { 1866 th->th_urp = 0; /* XXX */ 1867 tiflags &= ~TH_URG; /* XXX */ 1868 goto dodata; /* XXX */ 1869 } 1870 /* 1871 * If this segment advances the known urgent pointer, 1872 * then mark the data stream. This should not happen 1873 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since 1874 * a FIN has been received from the remote side. 1875 * In these states we ignore the URG. 1876 * 1877 * According to RFC961 (Assigned Protocols), 1878 * the urgent pointer points to the last octet 1879 * of urgent data. We continue, however, 1880 * to consider it to indicate the first octet 1881 * of data past the urgent section as the original 1882 * spec states (in one of two places). 1883 */ 1884 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) { 1885 tp->rcv_up = th->th_seq + th->th_urp; 1886 so->so_oobmark = so->so_rcv.sb_cc + 1887 (tp->rcv_up - tp->rcv_nxt) - 1; 1888 if (so->so_oobmark == 0) 1889 so->so_state |= SS_RCVATMARK; 1890 sohasoutofband(so); 1891 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA); 1892 } 1893 /* 1894 * Remove out of band data so doesn't get presented to user. 1895 * This can happen independent of advancing the URG pointer, 1896 * but if two URG's are pending at once, some out-of-band 1897 * data may creep in... ick. 1898 */ 1899 if (th->th_urp <= (u_int16_t) tlen 1900 #ifdef SO_OOBINLINE 1901 && (so->so_options & SO_OOBINLINE) == 0 1902 #endif 1903 ) 1904 tcp_pulloutofband(so, th, m, hdroptlen); 1905 } else 1906 /* 1907 * If no out of band data is expected, 1908 * pull receive urgent pointer along 1909 * with the receive window. 1910 */ 1911 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up)) 1912 tp->rcv_up = tp->rcv_nxt; 1913 dodata: /* XXX */ 1914 1915 /* 1916 * Process the segment text, merging it into the TCP sequencing queue, 1917 * and arranging for acknowledgement of receipt if necessary. 1918 * This process logically involves adjusting tp->rcv_wnd as data 1919 * is presented to the user (this happens in tcp_usrreq.c, 1920 * case PRU_RCVD). If a FIN has already been received on this 1921 * connection then we just ignore the text. 1922 */ 1923 if ((tlen || (tiflags & TH_FIN)) && 1924 TCPS_HAVERCVDFIN(tp->t_state) == 0) { 1925 /* 1926 * Insert segment ti into reassembly queue of tcp with 1927 * control block tp. Return TH_FIN if reassembly now includes 1928 * a segment with FIN. The macro form does the common case 1929 * inline (segment is the next to be received on an 1930 * established connection, and the queue is empty), 1931 * avoiding linkage into and removal from the queue and 1932 * repetition of various conversions. 1933 * Set DELACK for segments received in order, but ack 1934 * immediately when segments are out of order 1935 * (so fast retransmit can work). 1936 */ 1937 /* NOTE: this was TCP_REASS() macro, but used only once */ 1938 TCP_REASS_LOCK(tp); 1939 if (th->th_seq == tp->rcv_nxt && 1940 tp->segq.lh_first == NULL && 1941 tp->t_state == TCPS_ESTABLISHED) { 1942 TCP_SETUP_ACK(tp, th); 1943 tp->rcv_nxt += tlen; 1944 tiflags = th->th_flags & TH_FIN; 1945 tcpstat.tcps_rcvpack++; 1946 tcpstat.tcps_rcvbyte += tlen; 1947 ND6_HINT(tp); 1948 m_adj(m, hdroptlen); 1949 sbappend(&(so)->so_rcv, m); 1950 sorwakeup(so); 1951 } else { 1952 m_adj(m, hdroptlen); 1953 tiflags = tcp_reass(tp, th, m, &tlen); 1954 tp->t_flags |= TF_ACKNOW; 1955 } 1956 TCP_REASS_UNLOCK(tp); 1957 1958 /* 1959 * Note the amount of data that peer has sent into 1960 * our window, in order to estimate the sender's 1961 * buffer size. 1962 */ 1963 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt); 1964 } else { 1965 m_freem(m); 1966 m = NULL; 1967 tiflags &= ~TH_FIN; 1968 } 1969 1970 /* 1971 * If FIN is received ACK the FIN and let the user know 1972 * that the connection is closing. Ignore a FIN received before 1973 * the connection is fully established. 1974 */ 1975 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) { 1976 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) { 1977 socantrcvmore(so); 1978 tp->t_flags |= TF_ACKNOW; 1979 tp->rcv_nxt++; 1980 } 1981 switch (tp->t_state) { 1982 1983 /* 1984 * In ESTABLISHED STATE enter the CLOSE_WAIT state. 1985 */ 1986 case TCPS_ESTABLISHED: 1987 tp->t_state = TCPS_CLOSE_WAIT; 1988 break; 1989 1990 /* 1991 * If still in FIN_WAIT_1 STATE FIN has not been acked so 1992 * enter the CLOSING state. 1993 */ 1994 case TCPS_FIN_WAIT_1: 1995 tp->t_state = TCPS_CLOSING; 1996 break; 1997 1998 /* 1999 * In FIN_WAIT_2 state enter the TIME_WAIT state, 2000 * starting the time-wait timer, turning off the other 2001 * standard timers. 2002 */ 2003 case TCPS_FIN_WAIT_2: 2004 tp->t_state = TCPS_TIME_WAIT; 2005 tcp_canceltimers(tp); 2006 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 2007 soisdisconnected(so); 2008 break; 2009 2010 /* 2011 * In TIME_WAIT state restart the 2 MSL time_wait timer. 2012 */ 2013 case TCPS_TIME_WAIT: 2014 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL); 2015 break; 2016 } 2017 } 2018 if (so->so_options & SO_DEBUG) { 2019 tcp_trace(TA_INPUT, ostate, tp, tcp_saveti, 0); 2020 } 2021 2022 /* 2023 * Return any desired output. 2024 */ 2025 if (needoutput || (tp->t_flags & TF_ACKNOW)) 2026 (void) tcp_output(tp); 2027 if (tcp_saveti) 2028 m_freem(tcp_saveti); 2029 return; 2030 2031 badsyn: 2032 /* 2033 * Received a bad SYN. Increment counters and dropwithreset. 2034 */ 2035 tcpstat.tcps_badsyn++; 2036 tp = NULL; 2037 goto dropwithreset; 2038 2039 dropafterack: 2040 /* 2041 * Generate an ACK dropping incoming segment if it occupies 2042 * sequence space, where the ACK reflects our state. 2043 */ 2044 if (tiflags & TH_RST) 2045 goto drop; 2046 m_freem(m); 2047 tp->t_flags |= TF_ACKNOW; 2048 (void) tcp_output(tp); 2049 if (tcp_saveti) 2050 m_freem(tcp_saveti); 2051 return; 2052 2053 dropwithreset: 2054 /* 2055 * Generate a RST, dropping incoming segment. 2056 * Make ACK acceptable to originator of segment. 2057 * Don't bother to respond if destination was broadcast/multicast. 2058 */ 2059 if ((tiflags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST)) 2060 goto drop; 2061 if (ip && IN_MULTICAST(ip->ip_dst.s_addr)) 2062 goto drop; 2063 #ifdef INET6 2064 if (m->m_flags & M_ANYCAST6) 2065 goto drop; 2066 else if (ip6 && IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) 2067 goto drop; 2068 #endif 2069 { 2070 /* 2071 * need to recover version # field, which was overwritten on 2072 * ip_cksum computation. 2073 */ 2074 struct ip *sip; 2075 sip = mtod(m, struct ip *); 2076 switch (af) { 2077 case AF_INET: 2078 sip->ip_v = 4; 2079 break; 2080 #ifdef INET6 2081 case AF_INET6: 2082 sip->ip_v = 6; 2083 break; 2084 #endif 2085 } 2086 } 2087 if (tiflags & TH_ACK) 2088 (void)tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack, TH_RST); 2089 else { 2090 if (tiflags & TH_SYN) 2091 tlen++; 2092 (void)tcp_respond(tp, m, m, th, th->th_seq + tlen, (tcp_seq)0, 2093 TH_RST|TH_ACK); 2094 } 2095 if (tcp_saveti) 2096 m_freem(tcp_saveti); 2097 return; 2098 2099 drop: 2100 /* 2101 * Drop space held by incoming segment and return. 2102 */ 2103 if (tp) { 2104 if (tp->t_inpcb) 2105 so = tp->t_inpcb->inp_socket; 2106 #ifdef INET6 2107 else if (tp->t_in6pcb) 2108 so = tp->t_in6pcb->in6p_socket; 2109 #endif 2110 else 2111 so = NULL; 2112 if (so && (so->so_options & SO_DEBUG) != 0) 2113 tcp_trace(TA_DROP, ostate, tp, tcp_saveti, 0); 2114 } 2115 if (tcp_saveti) 2116 m_freem(tcp_saveti); 2117 m_freem(m); 2118 return; 2119 } 2120 2121 void 2122 tcp_dooptions(tp, cp, cnt, th, oi) 2123 struct tcpcb *tp; 2124 u_char *cp; 2125 int cnt; 2126 struct tcphdr *th; 2127 struct tcp_opt_info *oi; 2128 { 2129 u_int16_t mss; 2130 int opt, optlen; 2131 2132 for (; cnt > 0; cnt -= optlen, cp += optlen) { 2133 opt = cp[0]; 2134 if (opt == TCPOPT_EOL) 2135 break; 2136 if (opt == TCPOPT_NOP) 2137 optlen = 1; 2138 else { 2139 optlen = cp[1]; 2140 if (optlen <= 0) 2141 break; 2142 } 2143 switch (opt) { 2144 2145 default: 2146 continue; 2147 2148 case TCPOPT_MAXSEG: 2149 if (optlen != TCPOLEN_MAXSEG) 2150 continue; 2151 if (!(th->th_flags & TH_SYN)) 2152 continue; 2153 bcopy(cp + 2, &mss, sizeof(mss)); 2154 oi->maxseg = ntohs(mss); 2155 break; 2156 2157 case TCPOPT_WINDOW: 2158 if (optlen != TCPOLEN_WINDOW) 2159 continue; 2160 if (!(th->th_flags & TH_SYN)) 2161 continue; 2162 tp->t_flags |= TF_RCVD_SCALE; 2163 tp->requested_s_scale = cp[2]; 2164 if (tp->requested_s_scale > TCP_MAX_WINSHIFT) { 2165 #if 0 /*XXX*/ 2166 char *p; 2167 2168 if (ip) 2169 p = ntohl(ip->ip_src); 2170 #ifdef INET6 2171 else if (ip6) 2172 p = ip6_sprintf(&ip6->ip6_src); 2173 #endif 2174 else 2175 p = "(unknown)"; 2176 log(LOG_ERR, "TCP: invalid wscale %d from %s, " 2177 "assuming %d\n", 2178 tp->requested_s_scale, p, 2179 TCP_MAX_WINSHIFT); 2180 #else 2181 log(LOG_ERR, "TCP: invalid wscale %d, " 2182 "assuming %d\n", 2183 tp->requested_s_scale, 2184 TCP_MAX_WINSHIFT); 2185 #endif 2186 tp->requested_s_scale = TCP_MAX_WINSHIFT; 2187 } 2188 break; 2189 2190 case TCPOPT_TIMESTAMP: 2191 if (optlen != TCPOLEN_TIMESTAMP) 2192 continue; 2193 oi->ts_present = 1; 2194 bcopy(cp + 2, &oi->ts_val, sizeof(oi->ts_val)); 2195 NTOHL(oi->ts_val); 2196 bcopy(cp + 6, &oi->ts_ecr, sizeof(oi->ts_ecr)); 2197 NTOHL(oi->ts_ecr); 2198 2199 /* 2200 * A timestamp received in a SYN makes 2201 * it ok to send timestamp requests and replies. 2202 */ 2203 if (th->th_flags & TH_SYN) { 2204 tp->t_flags |= TF_RCVD_TSTMP; 2205 tp->ts_recent = oi->ts_val; 2206 tp->ts_recent_age = tcp_now; 2207 } 2208 break; 2209 case TCPOPT_SACK_PERMITTED: 2210 if (optlen != TCPOLEN_SACK_PERMITTED) 2211 continue; 2212 if (!(th->th_flags & TH_SYN)) 2213 continue; 2214 tp->t_flags &= ~TF_CANT_TXSACK; 2215 break; 2216 2217 case TCPOPT_SACK: 2218 if (tp->t_flags & TF_IGNR_RXSACK) 2219 continue; 2220 if (optlen % 8 != 2 || optlen < 10) 2221 continue; 2222 cp += 2; 2223 optlen -= 2; 2224 for (; optlen > 0; cp -= 8, optlen -= 8) { 2225 tcp_seq lwe, rwe; 2226 bcopy((char *)cp, (char *) &lwe, sizeof(lwe)); 2227 NTOHL(lwe); 2228 bcopy((char *)cp, (char *) &rwe, sizeof(rwe)); 2229 NTOHL(rwe); 2230 /* tcp_mark_sacked(tp, lwe, rwe); */ 2231 } 2232 break; 2233 } 2234 } 2235 } 2236 2237 /* 2238 * Pull out of band byte out of a segment so 2239 * it doesn't appear in the user's data queue. 2240 * It is still reflected in the segment length for 2241 * sequencing purposes. 2242 */ 2243 void 2244 tcp_pulloutofband(so, th, m, off) 2245 struct socket *so; 2246 struct tcphdr *th; 2247 register struct mbuf *m; 2248 int off; 2249 { 2250 int cnt = off + th->th_urp - 1; 2251 2252 while (cnt >= 0) { 2253 if (m->m_len > cnt) { 2254 char *cp = mtod(m, caddr_t) + cnt; 2255 struct tcpcb *tp = sototcpcb(so); 2256 2257 tp->t_iobc = *cp; 2258 tp->t_oobflags |= TCPOOB_HAVEDATA; 2259 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1)); 2260 m->m_len--; 2261 return; 2262 } 2263 cnt -= m->m_len; 2264 m = m->m_next; 2265 if (m == 0) 2266 break; 2267 } 2268 panic("tcp_pulloutofband"); 2269 } 2270 2271 /* 2272 * Collect new round-trip time estimate 2273 * and update averages and current timeout. 2274 */ 2275 void 2276 tcp_xmit_timer(tp, rtt) 2277 register struct tcpcb *tp; 2278 short rtt; 2279 { 2280 register short delta; 2281 short rttmin; 2282 2283 tcpstat.tcps_rttupdated++; 2284 --rtt; 2285 if (tp->t_srtt != 0) { 2286 /* 2287 * srtt is stored as fixed point with 3 bits after the 2288 * binary point (i.e., scaled by 8). The following magic 2289 * is equivalent to the smoothing algorithm in rfc793 with 2290 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed 2291 * point). Adjust rtt to origin 0. 2292 */ 2293 delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT); 2294 if ((tp->t_srtt += delta) <= 0) 2295 tp->t_srtt = 1 << 2; 2296 /* 2297 * We accumulate a smoothed rtt variance (actually, a 2298 * smoothed mean difference), then set the retransmit 2299 * timer to smoothed rtt + 4 times the smoothed variance. 2300 * rttvar is stored as fixed point with 2 bits after the 2301 * binary point (scaled by 4). The following is 2302 * equivalent to rfc793 smoothing with an alpha of .75 2303 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces 2304 * rfc793's wired-in beta. 2305 */ 2306 if (delta < 0) 2307 delta = -delta; 2308 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT); 2309 if ((tp->t_rttvar += delta) <= 0) 2310 tp->t_rttvar = 1 << 2; 2311 } else { 2312 /* 2313 * No rtt measurement yet - use the unsmoothed rtt. 2314 * Set the variance to half the rtt (so our first 2315 * retransmit happens at 3*rtt). 2316 */ 2317 tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2); 2318 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1); 2319 } 2320 tp->t_rtt = 0; 2321 tp->t_rxtshift = 0; 2322 2323 /* 2324 * the retransmit should happen at rtt + 4 * rttvar. 2325 * Because of the way we do the smoothing, srtt and rttvar 2326 * will each average +1/2 tick of bias. When we compute 2327 * the retransmit timer, we want 1/2 tick of rounding and 2328 * 1 extra tick because of +-1/2 tick uncertainty in the 2329 * firing of the timer. The bias will give us exactly the 2330 * 1.5 tick we need. But, because the bias is 2331 * statistical, we have to test that we don't drop below 2332 * the minimum feasible timer (which is 2 ticks). 2333 */ 2334 if (tp->t_rttmin > rtt + 2) 2335 rttmin = tp->t_rttmin; 2336 else 2337 rttmin = rtt + 2; 2338 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), rttmin, TCPTV_REXMTMAX); 2339 2340 /* 2341 * We received an ack for a packet that wasn't retransmitted; 2342 * it is probably safe to discard any error indications we've 2343 * received recently. This isn't quite right, but close enough 2344 * for now (a route might have failed after we sent a segment, 2345 * and the return path might not be symmetrical). 2346 */ 2347 tp->t_softerror = 0; 2348 } 2349 2350 /* 2351 * Checks for partial ack. If partial ack arrives, force the retransmission 2352 * of the next unacknowledged segment, do not clear tp->t_dupacks, and return 2353 * 1. By setting snd_nxt to th_ack, this forces retransmission timer to 2354 * be started again. If the ack advances at least to tp->snd_recover, return 0. 2355 */ 2356 int 2357 tcp_newreno(tp, th) 2358 struct tcpcb *tp; 2359 struct tcphdr *th; 2360 { 2361 tcp_seq onxt = tp->snd_nxt; 2362 u_long ocwnd = tp->snd_cwnd; 2363 2364 if (SEQ_LT(th->th_ack, tp->snd_recover)) { 2365 /* 2366 * snd_una has not yet been updated and the socket's send 2367 * buffer has not yet drained off the ACK'd data, so we 2368 * have to leave snd_una as it was to get the correct data 2369 * offset in tcp_output(). 2370 */ 2371 TCP_TIMER_DISARM(tp, TCPT_REXMT); 2372 tp->t_rtt = 0; 2373 tp->snd_nxt = th->th_ack; 2374 /* 2375 * Set snd_cwnd to one segment beyond ACK'd offset. snd_una 2376 * is not yet updated when we're called. 2377 */ 2378 tp->snd_cwnd = tp->t_segsz + (th->th_ack - tp->snd_una); 2379 (void) tcp_output(tp); 2380 tp->snd_cwnd = ocwnd; 2381 if (SEQ_GT(onxt, tp->snd_nxt)) 2382 tp->snd_nxt = onxt; 2383 /* 2384 * Partial window deflation. Relies on fact that tp->snd_una 2385 * not updated yet. 2386 */ 2387 tp->snd_cwnd -= (th->th_ack - tp->snd_una - tp->t_segsz); 2388 return 1; 2389 } 2390 return 0; 2391 } 2392 2393 2394 /* 2395 * TCP compressed state engine. Currently used to hold compressed 2396 * state for SYN_RECEIVED. 2397 */ 2398 2399 u_long syn_cache_count; 2400 u_int32_t syn_hash1, syn_hash2; 2401 2402 #define SYN_HASH(sa, sp, dp) \ 2403 ((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \ 2404 ((u_int32_t)(sp)))^syn_hash2))) 2405 #ifndef INET6 2406 #define SYN_HASHALL(hash, src, dst) \ 2407 do { \ 2408 hash = SYN_HASH(&((struct sockaddr_in *)(src))->sin_addr, \ 2409 ((struct sockaddr_in *)(src))->sin_port, \ 2410 ((struct sockaddr_in *)(dst))->sin_port); \ 2411 } while (0) 2412 #else 2413 #define SYN_HASH6(sa, sp, dp) \ 2414 ((((sa)->s6_addr32[0] ^ (sa)->s6_addr32[3] ^ syn_hash1) * \ 2415 (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp)))^syn_hash2)) \ 2416 & 0x7fffffff) 2417 2418 #define SYN_HASHALL(hash, src, dst) \ 2419 do { \ 2420 switch ((src)->sa_family) { \ 2421 case AF_INET: \ 2422 hash = SYN_HASH(&((struct sockaddr_in *)(src))->sin_addr, \ 2423 ((struct sockaddr_in *)(src))->sin_port, \ 2424 ((struct sockaddr_in *)(dst))->sin_port); \ 2425 break; \ 2426 case AF_INET6: \ 2427 hash = SYN_HASH6(&((struct sockaddr_in6 *)(src))->sin6_addr, \ 2428 ((struct sockaddr_in6 *)(src))->sin6_port, \ 2429 ((struct sockaddr_in6 *)(dst))->sin6_port); \ 2430 break; \ 2431 default: \ 2432 hash = 0; \ 2433 } \ 2434 } while (0) 2435 #endif /* INET6 */ 2436 2437 #define SYN_CACHE_RM(sc) \ 2438 do { \ 2439 LIST_REMOVE((sc), sc_bucketq); \ 2440 (sc)->sc_tp = NULL; \ 2441 LIST_REMOVE((sc), sc_tpq); \ 2442 tcp_syn_cache[(sc)->sc_bucketidx].sch_length--; \ 2443 TAILQ_REMOVE(&tcp_syn_cache_timeq[(sc)->sc_rxtshift], (sc), sc_timeq); \ 2444 syn_cache_count--; \ 2445 } while (0) 2446 2447 #define SYN_CACHE_PUT(sc) \ 2448 do { \ 2449 if ((sc)->sc_ipopts) \ 2450 (void) m_free((sc)->sc_ipopts); \ 2451 if ((sc)->sc_route4.ro_rt != NULL) \ 2452 RTFREE((sc)->sc_route4.ro_rt); \ 2453 pool_put(&syn_cache_pool, (sc)); \ 2454 } while (0) 2455 2456 struct pool syn_cache_pool; 2457 2458 /* 2459 * We don't estimate RTT with SYNs, so each packet starts with the default 2460 * RTT and each timer queue has a fixed timeout value. This allows us to 2461 * optimize the timer queues somewhat. 2462 */ 2463 #define SYN_CACHE_TIMER_ARM(sc) \ 2464 do { \ 2465 TCPT_RANGESET((sc)->sc_rxtcur, \ 2466 TCPTV_SRTTDFLT * tcp_backoff[(sc)->sc_rxtshift], TCPTV_MIN, \ 2467 TCPTV_REXMTMAX); \ 2468 PRT_SLOW_ARM((sc)->sc_rexmt, (sc)->sc_rxtcur); \ 2469 } while (0) 2470 2471 TAILQ_HEAD(, syn_cache) tcp_syn_cache_timeq[TCP_MAXRXTSHIFT + 1]; 2472 2473 void 2474 syn_cache_init() 2475 { 2476 int i; 2477 2478 /* Initialize the hash buckets. */ 2479 for (i = 0; i < tcp_syn_cache_size; i++) 2480 LIST_INIT(&tcp_syn_cache[i].sch_bucket); 2481 2482 /* Initialize the timer queues. */ 2483 for (i = 0; i <= TCP_MAXRXTSHIFT; i++) 2484 TAILQ_INIT(&tcp_syn_cache_timeq[i]); 2485 2486 /* Initialize the syn cache pool. */ 2487 pool_init(&syn_cache_pool, sizeof(struct syn_cache), 0, 0, 0, 2488 "synpl", 0, NULL, NULL, M_PCB); 2489 } 2490 2491 void 2492 syn_cache_insert(sc, tp) 2493 struct syn_cache *sc; 2494 struct tcpcb *tp; 2495 { 2496 struct syn_cache_head *scp; 2497 struct syn_cache *sc2; 2498 int s, i; 2499 2500 /* 2501 * If there are no entries in the hash table, reinitialize 2502 * the hash secrets. 2503 */ 2504 if (syn_cache_count == 0) { 2505 struct timeval tv; 2506 microtime(&tv); 2507 syn_hash1 = random() ^ (u_long)≻ 2508 syn_hash2 = random() ^ tv.tv_usec; 2509 } 2510 2511 SYN_HASHALL(sc->sc_hash, &sc->sc_src.sa, &sc->sc_dst.sa); 2512 sc->sc_bucketidx = sc->sc_hash % tcp_syn_cache_size; 2513 scp = &tcp_syn_cache[sc->sc_bucketidx]; 2514 2515 /* 2516 * Make sure that we don't overflow the per-bucket 2517 * limit or the total cache size limit. 2518 */ 2519 s = splsoftnet(); 2520 if (scp->sch_length >= tcp_syn_bucket_limit) { 2521 tcpstat.tcps_sc_bucketoverflow++; 2522 /* 2523 * The bucket is full. Toss the oldest element in the 2524 * bucket. This will be the entry with our bucket 2525 * index closest to the front of the timer queue with 2526 * the largest timeout value. 2527 * 2528 * Note: This timer queue traversal may be expensive, so 2529 * we hope that this doesn't happen very often. It is 2530 * much more likely that we'll overflow the entire 2531 * cache, which is much easier to handle; see below. 2532 */ 2533 for (i = TCP_MAXRXTSHIFT; i >= 0; i--) { 2534 for (sc2 = TAILQ_FIRST(&tcp_syn_cache_timeq[i]); 2535 sc2 != NULL; 2536 sc2 = TAILQ_NEXT(sc2, sc_timeq)) { 2537 if (sc2->sc_bucketidx == sc->sc_bucketidx) { 2538 SYN_CACHE_RM(sc2); 2539 SYN_CACHE_PUT(sc2); 2540 goto insert; /* 2 level break */ 2541 } 2542 } 2543 } 2544 #ifdef DIAGNOSTIC 2545 /* 2546 * This should never happen; we should always find an 2547 * entry in our bucket. 2548 */ 2549 panic("syn_cache_insert: bucketoverflow: impossible"); 2550 #endif 2551 } else if (syn_cache_count >= tcp_syn_cache_limit) { 2552 tcpstat.tcps_sc_overflowed++; 2553 /* 2554 * The cache is full. Toss the oldest entry in the 2555 * entire cache. This is the front entry in the 2556 * first non-empty timer queue with the largest 2557 * timeout value. 2558 */ 2559 for (i = TCP_MAXRXTSHIFT; i >= 0; i--) { 2560 sc2 = TAILQ_FIRST(&tcp_syn_cache_timeq[i]); 2561 if (sc2 == NULL) 2562 continue; 2563 SYN_CACHE_RM(sc2); 2564 SYN_CACHE_PUT(sc2); 2565 goto insert; /* symmetry with above */ 2566 } 2567 #ifdef DIAGNOSTIC 2568 /* 2569 * This should never happen; we should always find an 2570 * entry in the cache. 2571 */ 2572 panic("syn_cache_insert: cache overflow: impossible"); 2573 #endif 2574 } 2575 2576 insert: 2577 /* 2578 * Initialize the entry's timer. 2579 */ 2580 sc->sc_rxttot = 0; 2581 sc->sc_rxtshift = 0; 2582 SYN_CACHE_TIMER_ARM(sc); 2583 TAILQ_INSERT_TAIL(&tcp_syn_cache_timeq[sc->sc_rxtshift], sc, sc_timeq); 2584 2585 /* Link it from tcpcb entry */ 2586 LIST_INSERT_HEAD(&tp->t_sc, sc, sc_tpq); 2587 2588 /* Put it into the bucket. */ 2589 LIST_INSERT_HEAD(&scp->sch_bucket, sc, sc_bucketq); 2590 scp->sch_length++; 2591 syn_cache_count++; 2592 2593 tcpstat.tcps_sc_added++; 2594 splx(s); 2595 } 2596 2597 /* 2598 * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted. 2599 * If we have retransmitted an entry the maximum number of times, expire 2600 * that entry. 2601 */ 2602 void 2603 syn_cache_timer() 2604 { 2605 struct syn_cache *sc, *nsc; 2606 int i, s; 2607 2608 s = splsoftnet(); 2609 2610 /* 2611 * First, get all the entries that need to be retransmitted, or 2612 * must be expired due to exceeding the initial keepalive time. 2613 */ 2614 for (i = 0; i < TCP_MAXRXTSHIFT; i++) { 2615 for (sc = TAILQ_FIRST(&tcp_syn_cache_timeq[i]); 2616 sc != NULL && PRT_SLOW_ISEXPIRED(sc->sc_rexmt); 2617 sc = nsc) { 2618 nsc = TAILQ_NEXT(sc, sc_timeq); 2619 2620 /* 2621 * Compute the total amount of time this entry has 2622 * been on a queue. If this entry has been on longer 2623 * than the keep alive timer would allow, expire it. 2624 */ 2625 sc->sc_rxttot += sc->sc_rxtcur; 2626 if (sc->sc_rxttot >= TCPTV_KEEP_INIT) { 2627 tcpstat.tcps_sc_timed_out++; 2628 SYN_CACHE_RM(sc); 2629 SYN_CACHE_PUT(sc); 2630 continue; 2631 } 2632 2633 tcpstat.tcps_sc_retransmitted++; 2634 (void) syn_cache_respond(sc, NULL); 2635 2636 /* Advance this entry onto the next timer queue. */ 2637 TAILQ_REMOVE(&tcp_syn_cache_timeq[i], sc, sc_timeq); 2638 sc->sc_rxtshift = i + 1; 2639 SYN_CACHE_TIMER_ARM(sc); 2640 TAILQ_INSERT_TAIL(&tcp_syn_cache_timeq[sc->sc_rxtshift], 2641 sc, sc_timeq); 2642 } 2643 } 2644 2645 /* 2646 * Now get all the entries that are expired due to too many 2647 * retransmissions. 2648 */ 2649 for (sc = TAILQ_FIRST(&tcp_syn_cache_timeq[TCP_MAXRXTSHIFT]); 2650 sc != NULL && PRT_SLOW_ISEXPIRED(sc->sc_rexmt); 2651 sc = nsc) { 2652 nsc = TAILQ_NEXT(sc, sc_timeq); 2653 tcpstat.tcps_sc_timed_out++; 2654 SYN_CACHE_RM(sc); 2655 SYN_CACHE_PUT(sc); 2656 } 2657 splx(s); 2658 } 2659 2660 /* 2661 * Remove syn cache created by the specified tcb entry, 2662 * because this does not make sense to keep them 2663 * (if there's no tcb entry, syn cache entry will never be used) 2664 */ 2665 void 2666 syn_cache_cleanup(tp) 2667 struct tcpcb *tp; 2668 { 2669 struct syn_cache *sc, *nsc; 2670 int s; 2671 2672 s = splsoftnet(); 2673 2674 for (sc = LIST_FIRST(&tp->t_sc); sc != NULL; sc = nsc) { 2675 nsc = LIST_NEXT(sc, sc_tpq); 2676 2677 #ifdef DIAGNOSTIC 2678 if (sc->sc_tp != tp) 2679 panic("invalid sc_tp in syn_cache_cleanup"); 2680 #endif 2681 SYN_CACHE_RM(sc); 2682 SYN_CACHE_PUT(sc); 2683 } 2684 /* just for safety */ 2685 LIST_INIT(&tp->t_sc); 2686 2687 splx(s); 2688 } 2689 2690 /* 2691 * Find an entry in the syn cache. 2692 */ 2693 struct syn_cache * 2694 syn_cache_lookup(src, dst, headp) 2695 struct sockaddr *src; 2696 struct sockaddr *dst; 2697 struct syn_cache_head **headp; 2698 { 2699 struct syn_cache *sc; 2700 struct syn_cache_head *scp; 2701 u_int32_t hash; 2702 int s; 2703 2704 SYN_HASHALL(hash, src, dst); 2705 2706 scp = &tcp_syn_cache[hash % tcp_syn_cache_size]; 2707 *headp = scp; 2708 s = splsoftnet(); 2709 for (sc = LIST_FIRST(&scp->sch_bucket); sc != NULL; 2710 sc = LIST_NEXT(sc, sc_bucketq)) { 2711 if (sc->sc_hash != hash) 2712 continue; 2713 if (!bcmp(&sc->sc_src, src, src->sa_len) && 2714 !bcmp(&sc->sc_dst, dst, dst->sa_len)) { 2715 splx(s); 2716 return (sc); 2717 } 2718 } 2719 splx(s); 2720 return (NULL); 2721 } 2722 2723 /* 2724 * This function gets called when we receive an ACK for a 2725 * socket in the LISTEN state. We look up the connection 2726 * in the syn cache, and if its there, we pull it out of 2727 * the cache and turn it into a full-blown connection in 2728 * the SYN-RECEIVED state. 2729 * 2730 * The return values may not be immediately obvious, and their effects 2731 * can be subtle, so here they are: 2732 * 2733 * NULL SYN was not found in cache; caller should drop the 2734 * packet and send an RST. 2735 * 2736 * -1 We were unable to create the new connection, and are 2737 * aborting it. An ACK,RST is being sent to the peer 2738 * (unless we got screwey sequence numbners; see below), 2739 * because the 3-way handshake has been completed. Caller 2740 * should not free the mbuf, since we may be using it. If 2741 * we are not, we will free it. 2742 * 2743 * Otherwise, the return value is a pointer to the new socket 2744 * associated with the connection. 2745 */ 2746 struct socket * 2747 syn_cache_get(src, dst, th, hlen, tlen, so, m) 2748 struct sockaddr *src; 2749 struct sockaddr *dst; 2750 struct tcphdr *th; 2751 unsigned int hlen, tlen; 2752 struct socket *so; 2753 struct mbuf *m; 2754 { 2755 struct syn_cache *sc; 2756 struct syn_cache_head *scp; 2757 register struct inpcb *inp = NULL; 2758 #ifdef INET6 2759 register struct in6pcb *in6p = NULL; 2760 #endif 2761 register struct tcpcb *tp = 0; 2762 struct mbuf *am; 2763 int s; 2764 struct socket *oso; 2765 2766 s = splsoftnet(); 2767 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) { 2768 splx(s); 2769 return (NULL); 2770 } 2771 2772 /* 2773 * Verify the sequence and ack numbers. Try getting the correct 2774 * response again. 2775 */ 2776 if ((th->th_ack != sc->sc_iss + 1) || 2777 SEQ_LEQ(th->th_seq, sc->sc_irs) || 2778 SEQ_GT(th->th_seq, sc->sc_irs + 1 + sc->sc_win)) { 2779 (void) syn_cache_respond(sc, m); 2780 splx(s); 2781 return ((struct socket *)(-1)); 2782 } 2783 2784 /* Remove this cache entry */ 2785 SYN_CACHE_RM(sc); 2786 splx(s); 2787 2788 /* 2789 * Ok, create the full blown connection, and set things up 2790 * as they would have been set up if we had created the 2791 * connection when the SYN arrived. If we can't create 2792 * the connection, abort it. 2793 */ 2794 /* 2795 * inp still has the OLD in_pcb stuff, set the 2796 * v6-related flags on the new guy, too. This is 2797 * done particularly for the case where an AF_INET6 2798 * socket is bound only to a port, and a v4 connection 2799 * comes in on that port. 2800 * we also copy the flowinfo from the original pcb 2801 * to the new one. 2802 */ 2803 { 2804 struct inpcb *parentinpcb; 2805 2806 parentinpcb = (struct inpcb *)so->so_pcb; 2807 2808 oso = so; 2809 so = sonewconn(so, SS_ISCONNECTED); 2810 if (so == NULL) 2811 goto resetandabort; 2812 2813 switch (so->so_proto->pr_domain->dom_family) { 2814 case AF_INET: 2815 inp = sotoinpcb(so); 2816 break; 2817 #ifdef INET6 2818 case AF_INET6: 2819 in6p = sotoin6pcb(so); 2820 #if 0 /*def INET6*/ 2821 inp->inp_flags |= (parentinpcb->inp_flags & 2822 (INP_IPV6 | INP_IPV6_UNDEC | INP_IPV6_MAPPED)); 2823 if ((inp->inp_flags & INP_IPV6) && 2824 !(inp->inp_flags & INP_IPV6_MAPPED)) { 2825 inp->inp_ipv6.ip6_hlim = parentinpcb->inp_ipv6.ip6_hlim; 2826 inp->inp_ipv6.ip6_vfc = parentinpcb->inp_ipv6.ip6_vfc; 2827 } 2828 #endif 2829 break; 2830 #endif 2831 } 2832 } 2833 switch (src->sa_family) { 2834 case AF_INET: 2835 if (inp) { 2836 inp->inp_laddr = ((struct sockaddr_in *)dst)->sin_addr; 2837 inp->inp_lport = ((struct sockaddr_in *)dst)->sin_port; 2838 inp->inp_options = ip_srcroute(); 2839 in_pcbstate(inp, INP_BOUND); 2840 if (inp->inp_options == NULL) { 2841 inp->inp_options = sc->sc_ipopts; 2842 sc->sc_ipopts = NULL; 2843 } 2844 } 2845 #ifdef INET6 2846 else if (in6p) { 2847 /* IPv4 packet to AF_INET6 socket */ 2848 bzero(&in6p->in6p_laddr, sizeof(in6p->in6p_laddr)); 2849 in6p->in6p_laddr.s6_addr16[5] = htons(0xffff); 2850 bcopy(&((struct sockaddr_in *)dst)->sin_addr, 2851 &in6p->in6p_laddr.s6_addr32[3], 2852 sizeof(((struct sockaddr_in *)dst)->sin_addr)); 2853 in6p->in6p_lport = ((struct sockaddr_in *)dst)->sin_port; 2854 in6totcpcb(in6p)->t_family = AF_INET; 2855 } 2856 #endif 2857 break; 2858 #ifdef INET6 2859 case AF_INET6: 2860 if (in6p) { 2861 in6p->in6p_laddr = ((struct sockaddr_in6 *)dst)->sin6_addr; 2862 in6p->in6p_lport = ((struct sockaddr_in6 *)dst)->sin6_port; 2863 #if 0 2864 in6p->in6p_flowinfo = ip6->ip6_flow & IPV6_FLOWINFO_MASK; 2865 /*inp->inp_options = ip6_srcroute();*/ /* soon. */ 2866 #endif 2867 } 2868 break; 2869 #endif 2870 } 2871 #ifdef INET6 2872 if (in6p && in6totcpcb(in6p)->t_family == AF_INET6 && sotoinpcb(oso)) { 2873 struct in6pcb *oin6p = sotoin6pcb(oso); 2874 /* inherit socket options from the listening socket */ 2875 in6p->in6p_flags |= (oin6p->in6p_flags & IN6P_CONTROLOPTS); 2876 if (in6p->in6p_flags & IN6P_CONTROLOPTS) { 2877 m_freem(in6p->in6p_options); 2878 in6p->in6p_options = 0; 2879 } 2880 ip6_savecontrol(in6p, &in6p->in6p_options, 2881 mtod(m, struct ip6_hdr *), m); 2882 } 2883 #endif 2884 2885 #ifdef IPSEC 2886 { 2887 struct secpolicy *sp; 2888 if (inp) { 2889 sp = ipsec_copy_policy(sotoinpcb(oso)->inp_sp); 2890 if (sp) { 2891 key_freesp(inp->inp_sp); 2892 inp->inp_sp = sp; 2893 } else 2894 printf("tcp_input: could not copy policy\n"); 2895 } 2896 #ifdef INET6 2897 else if (in6p) { 2898 sp = ipsec_copy_policy(sotoin6pcb(oso)->in6p_sp); 2899 if (sp) { 2900 key_freesp(in6p->in6p_sp); 2901 in6p->in6p_sp = sp; 2902 } else 2903 printf("tcp_input: could not copy policy\n"); 2904 } 2905 #endif 2906 } 2907 #endif 2908 2909 /* 2910 * Give the new socket our cached route reference. 2911 */ 2912 if (inp) 2913 inp->inp_route = sc->sc_route4; /* struct assignment */ 2914 #ifdef INET6 2915 else 2916 in6p->in6p_route = sc->sc_route6; 2917 #endif 2918 sc->sc_route4.ro_rt = NULL; 2919 2920 am = m_get(M_DONTWAIT, MT_SONAME); /* XXX */ 2921 if (am == NULL) 2922 goto resetandabort; 2923 am->m_len = src->sa_len; 2924 bcopy(src, mtod(am, caddr_t), src->sa_len); 2925 if (inp) { 2926 if (in_pcbconnect(inp, am)) { 2927 (void) m_free(am); 2928 goto resetandabort; 2929 } 2930 } 2931 #ifdef INET6 2932 else if (in6p) { 2933 if (src->sa_family == AF_INET) { 2934 /* IPv4 packet to AF_INET6 socket */ 2935 struct sockaddr_in6 *sin6; 2936 sin6 = mtod(am, struct sockaddr_in6 *); 2937 am->m_len = sizeof(*sin6); 2938 bzero(sin6, sizeof(*sin6)); 2939 sin6->sin6_family = AF_INET6; 2940 sin6->sin6_len = sizeof(*sin6); 2941 sin6->sin6_port = ((struct sockaddr_in *)src)->sin_port; 2942 sin6->sin6_addr.s6_addr16[5] = htons(0xffff); 2943 bcopy(&((struct sockaddr_in *)src)->sin_addr, 2944 &sin6->sin6_addr.s6_addr32[3], 2945 sizeof(sin6->sin6_addr.s6_addr32[3])); 2946 } 2947 if (in6_pcbconnect(in6p, am)) { 2948 (void) m_free(am); 2949 goto resetandabort; 2950 } 2951 } 2952 #endif 2953 else { 2954 (void) m_free(am); 2955 goto resetandabort; 2956 } 2957 (void) m_free(am); 2958 2959 if (inp) 2960 tp = intotcpcb(inp); 2961 #ifdef INET6 2962 else if (in6p) 2963 tp = in6totcpcb(in6p); 2964 #endif 2965 else 2966 tp = NULL; 2967 if (sc->sc_request_r_scale != 15) { 2968 tp->requested_s_scale = sc->sc_requested_s_scale; 2969 tp->request_r_scale = sc->sc_request_r_scale; 2970 tp->snd_scale = sc->sc_requested_s_scale; 2971 tp->rcv_scale = sc->sc_request_r_scale; 2972 tp->t_flags |= TF_RCVD_SCALE; 2973 } 2974 if (sc->sc_flags & SCF_TIMESTAMP) 2975 tp->t_flags |= TF_RCVD_TSTMP; 2976 2977 tp->t_template = tcp_template(tp); 2978 if (tp->t_template == 0) { 2979 tp = tcp_drop(tp, ENOBUFS); /* destroys socket */ 2980 so = NULL; 2981 m_freem(m); 2982 goto abort; 2983 } 2984 2985 tp->iss = sc->sc_iss; 2986 tp->irs = sc->sc_irs; 2987 tcp_sendseqinit(tp); 2988 tcp_rcvseqinit(tp); 2989 tp->t_state = TCPS_SYN_RECEIVED; 2990 TCP_TIMER_ARM(tp, TCPT_KEEP, TCPTV_KEEP_INIT); 2991 tcpstat.tcps_accepts++; 2992 2993 /* Initialize tp->t_ourmss before we deal with the peer's! */ 2994 tp->t_ourmss = sc->sc_ourmaxseg; 2995 tcp_mss_from_peer(tp, sc->sc_peermaxseg); 2996 2997 /* 2998 * Initialize the initial congestion window. If we 2999 * had to retransmit the SYN,ACK, we must initialize cwnd 3000 * to 1 segment (i.e. the Loss Window). 3001 */ 3002 if (sc->sc_rxtshift) 3003 tp->snd_cwnd = tp->t_peermss; 3004 else 3005 tp->snd_cwnd = TCP_INITIAL_WINDOW(tcp_init_win, tp->t_peermss); 3006 3007 tcp_rmx_rtt(tp); 3008 tp->snd_wl1 = sc->sc_irs; 3009 tp->rcv_up = sc->sc_irs + 1; 3010 3011 /* 3012 * This is what whould have happened in tcp_ouput() when 3013 * the SYN,ACK was sent. 3014 */ 3015 tp->snd_up = tp->snd_una; 3016 tp->snd_max = tp->snd_nxt = tp->iss+1; 3017 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); 3018 if (sc->sc_win > 0 && SEQ_GT(tp->rcv_nxt + sc->sc_win, tp->rcv_adv)) 3019 tp->rcv_adv = tp->rcv_nxt + sc->sc_win; 3020 tp->last_ack_sent = tp->rcv_nxt; 3021 3022 tcpstat.tcps_sc_completed++; 3023 SYN_CACHE_PUT(sc); 3024 return (so); 3025 3026 resetandabort: 3027 (void) tcp_respond(NULL, m, m, th, 3028 th->th_seq + tlen, (tcp_seq)0, TH_RST|TH_ACK); 3029 abort: 3030 if (so != NULL) 3031 (void) soabort(so); 3032 SYN_CACHE_PUT(sc); 3033 tcpstat.tcps_sc_aborted++; 3034 return ((struct socket *)(-1)); 3035 } 3036 3037 /* 3038 * This function is called when we get a RST for a 3039 * non-existant connection, so that we can see if the 3040 * connection is in the syn cache. If it is, zap it. 3041 */ 3042 3043 void 3044 syn_cache_reset(src, dst, th) 3045 struct sockaddr *src; 3046 struct sockaddr *dst; 3047 struct tcphdr *th; 3048 { 3049 struct syn_cache *sc; 3050 struct syn_cache_head *scp; 3051 int s = splsoftnet(); 3052 3053 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) { 3054 splx(s); 3055 return; 3056 } 3057 if (SEQ_LT(th->th_seq, sc->sc_irs) || 3058 SEQ_GT(th->th_seq, sc->sc_irs+1)) { 3059 splx(s); 3060 return; 3061 } 3062 SYN_CACHE_RM(sc); 3063 splx(s); 3064 tcpstat.tcps_sc_reset++; 3065 SYN_CACHE_PUT(sc); 3066 } 3067 3068 void 3069 syn_cache_unreach(src, dst, th) 3070 struct sockaddr *src; 3071 struct sockaddr *dst; 3072 struct tcphdr *th; 3073 { 3074 struct syn_cache *sc; 3075 struct syn_cache_head *scp; 3076 int s; 3077 3078 s = splsoftnet(); 3079 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) { 3080 splx(s); 3081 return; 3082 } 3083 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */ 3084 if (ntohl (th->th_seq) != sc->sc_iss) { 3085 splx(s); 3086 return; 3087 } 3088 3089 /* 3090 * If we've rertransmitted 3 times and this is our second error, 3091 * we remove the entry. Otherwise, we allow it to continue on. 3092 * This prevents us from incorrectly nuking an entry during a 3093 * spurious network outage. 3094 * 3095 * See tcp_notify(). 3096 */ 3097 if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtshift < 3) { 3098 sc->sc_flags |= SCF_UNREACH; 3099 splx(s); 3100 return; 3101 } 3102 3103 SYN_CACHE_RM(sc); 3104 splx(s); 3105 tcpstat.tcps_sc_unreach++; 3106 SYN_CACHE_PUT(sc); 3107 } 3108 3109 /* 3110 * Given a LISTEN socket and an inbound SYN request, add 3111 * this to the syn cache, and send back a segment: 3112 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK> 3113 * to the source. 3114 * 3115 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN. 3116 * Doing so would require that we hold onto the data and deliver it 3117 * to the application. However, if we are the target of a SYN-flood 3118 * DoS attack, an attacker could send data which would eventually 3119 * consume all available buffer space if it were ACKed. By not ACKing 3120 * the data, we avoid this DoS scenario. 3121 */ 3122 3123 int 3124 syn_cache_add(src, dst, th, hlen, so, m, optp, optlen, oi) 3125 struct sockaddr *src; 3126 struct sockaddr *dst; 3127 struct tcphdr *th; 3128 unsigned int hlen; 3129 struct socket *so; 3130 struct mbuf *m; 3131 u_char *optp; 3132 int optlen; 3133 struct tcp_opt_info *oi; 3134 { 3135 struct tcpcb tb, *tp; 3136 long win; 3137 struct syn_cache *sc; 3138 struct syn_cache_head *scp; 3139 struct mbuf *ipopts; 3140 3141 tp = sototcpcb(so); 3142 3143 /* 3144 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN 3145 * in_broadcast() should never return true on a received 3146 * packet with M_BCAST not set. 3147 */ 3148 if (m->m_flags & (M_BCAST|M_MCAST)) 3149 return 0; 3150 #ifdef INET6 3151 if (m->m_flags & M_ANYCAST6) 3152 return 0; 3153 #endif 3154 3155 switch (src->sa_family) { 3156 case AF_INET: 3157 if (IN_MULTICAST(((struct sockaddr_in *)src)->sin_addr.s_addr) 3158 || IN_MULTICAST(((struct sockaddr_in *)dst)->sin_addr.s_addr)) 3159 return 0; 3160 break; 3161 #ifdef INET6 3162 case AF_INET6: 3163 if (IN6_IS_ADDR_MULTICAST(&((struct sockaddr_in6 *)src)->sin6_addr) 3164 || IN6_IS_ADDR_MULTICAST(&((struct sockaddr_in6 *)dst)->sin6_addr)) 3165 return 0; 3166 break; 3167 #endif 3168 default: 3169 return 0; 3170 } 3171 3172 /* 3173 * Initialize some local state. 3174 */ 3175 win = sbspace(&so->so_rcv); 3176 if (win > TCP_MAXWIN) 3177 win = TCP_MAXWIN; 3178 3179 if (src->sa_family == AF_INET) { 3180 /* 3181 * Remember the IP options, if any. 3182 */ 3183 ipopts = ip_srcroute(); 3184 } else 3185 ipopts = NULL; 3186 3187 if (optp) { 3188 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0; 3189 tcp_dooptions(&tb, optp, optlen, th, oi); 3190 } else 3191 tb.t_flags = 0; 3192 3193 /* 3194 * See if we already have an entry for this connection. 3195 * If we do, resend the SYN,ACK. We do not count this 3196 * as a retransmission (XXX though maybe we should). 3197 */ 3198 if ((sc = syn_cache_lookup(src, dst, &scp)) != NULL) { 3199 tcpstat.tcps_sc_dupesyn++; 3200 if (ipopts) { 3201 /* 3202 * If we were remembering a previous source route, 3203 * forget it and use the new one we've been given. 3204 */ 3205 if (sc->sc_ipopts) 3206 (void) m_free(sc->sc_ipopts); 3207 sc->sc_ipopts = ipopts; 3208 } 3209 sc->sc_timestamp = tb.ts_recent; 3210 if (syn_cache_respond(sc, m) == 0) { 3211 tcpstat.tcps_sndacks++; 3212 tcpstat.tcps_sndtotal++; 3213 } 3214 return (1); 3215 } 3216 3217 sc = pool_get(&syn_cache_pool, PR_NOWAIT); 3218 if (sc == NULL) { 3219 if (ipopts) 3220 (void) m_free(ipopts); 3221 return (0); 3222 } 3223 3224 /* 3225 * Fill in the cache, and put the necessary IP and TCP 3226 * options into the reply. 3227 */ 3228 bzero(sc, sizeof(struct syn_cache)); 3229 bcopy(src, &sc->sc_src, src->sa_len); 3230 bcopy(dst, &sc->sc_dst, dst->sa_len); 3231 sc->sc_flags = 0; 3232 sc->sc_ipopts = ipopts; 3233 sc->sc_irs = th->th_seq; 3234 sc->sc_iss = tcp_new_iss(sc, sizeof(struct syn_cache), 0); 3235 sc->sc_peermaxseg = oi->maxseg; 3236 sc->sc_ourmaxseg = tcp_mss_to_advertise(m->m_flags & M_PKTHDR ? 3237 m->m_pkthdr.rcvif : NULL, 3238 sc->sc_src.sa.sa_family); 3239 sc->sc_win = win; 3240 sc->sc_timestamp = tb.ts_recent; 3241 if (tcp_do_rfc1323 && (tb.t_flags & TF_RCVD_TSTMP)) 3242 sc->sc_flags |= SCF_TIMESTAMP; 3243 if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == 3244 (TF_RCVD_SCALE|TF_REQ_SCALE)) { 3245 sc->sc_requested_s_scale = tb.requested_s_scale; 3246 sc->sc_request_r_scale = 0; 3247 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT && 3248 TCP_MAXWIN << sc->sc_request_r_scale < 3249 so->so_rcv.sb_hiwat) 3250 sc->sc_request_r_scale++; 3251 } else { 3252 sc->sc_requested_s_scale = 15; 3253 sc->sc_request_r_scale = 15; 3254 } 3255 sc->sc_tp = tp; 3256 if (syn_cache_respond(sc, m) == 0) { 3257 syn_cache_insert(sc, tp); 3258 tcpstat.tcps_sndacks++; 3259 tcpstat.tcps_sndtotal++; 3260 } else { 3261 SYN_CACHE_PUT(sc); 3262 tcpstat.tcps_sc_dropped++; 3263 } 3264 return (1); 3265 } 3266 3267 int 3268 syn_cache_respond(sc, m) 3269 struct syn_cache *sc; 3270 struct mbuf *m; 3271 { 3272 struct route *ro; 3273 struct rtentry *rt; 3274 u_int8_t *optp; 3275 int optlen, error; 3276 u_int16_t tlen; 3277 struct ip *ip = NULL; 3278 #ifdef INET6 3279 struct ip6_hdr *ip6 = NULL; 3280 #endif 3281 struct tcphdr *th; 3282 u_int hlen; 3283 3284 switch (sc->sc_src.sa.sa_family) { 3285 case AF_INET: 3286 hlen = sizeof(struct ip); 3287 ro = &sc->sc_route4; 3288 break; 3289 #ifdef INET6 3290 case AF_INET6: 3291 hlen = sizeof(struct ip6_hdr); 3292 ro = (struct route *)&sc->sc_route6; 3293 break; 3294 #endif 3295 default: 3296 if (m) 3297 m_freem(m); 3298 return EAFNOSUPPORT; 3299 } 3300 3301 /* Compute the size of the TCP options. */ 3302 optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) + 3303 ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0); 3304 3305 tlen = hlen + sizeof(struct tcphdr) + optlen; 3306 3307 /* 3308 * Create the IP+TCP header from scratch. Reuse the received mbuf 3309 * if possible. 3310 */ 3311 if (m != NULL) { 3312 m_freem(m->m_next); 3313 m->m_next = NULL; 3314 MRESETDATA(m); 3315 } else { 3316 MGETHDR(m, M_DONTWAIT, MT_DATA); 3317 if (m == NULL) 3318 return (ENOBUFS); 3319 } 3320 3321 /* Fixup the mbuf. */ 3322 m->m_data += max_linkhdr; 3323 m->m_len = m->m_pkthdr.len = tlen; 3324 #ifdef IPSEC 3325 if (sc->sc_tp) { 3326 struct tcpcb *tp; 3327 struct socket *so; 3328 3329 tp = sc->sc_tp; 3330 if (tp->t_inpcb) 3331 so = tp->t_inpcb->inp_socket; 3332 #ifdef INET6 3333 else if (tp->t_in6pcb) 3334 so = tp->t_in6pcb->in6p_socket; 3335 #endif 3336 else 3337 so = NULL; 3338 /* use IPsec policy on listening socket, on SYN ACK */ 3339 m->m_pkthdr.rcvif = (struct ifnet *)so; 3340 } 3341 #else 3342 m->m_pkthdr.rcvif = NULL; 3343 #endif 3344 memset(mtod(m, u_char *), 0, tlen); 3345 3346 switch (sc->sc_src.sa.sa_family) { 3347 case AF_INET: 3348 ip = mtod(m, struct ip *); 3349 ip->ip_dst = sc->sc_src.sin.sin_addr; 3350 ip->ip_src = sc->sc_dst.sin.sin_addr; 3351 ip->ip_p = IPPROTO_TCP; 3352 th = (struct tcphdr *)(ip + 1); 3353 th->th_dport = sc->sc_src.sin.sin_port; 3354 th->th_sport = sc->sc_dst.sin.sin_port; 3355 break; 3356 #ifdef INET6 3357 case AF_INET6: 3358 ip6 = mtod(m, struct ip6_hdr *); 3359 ip6->ip6_dst = sc->sc_src.sin6.sin6_addr; 3360 ip6->ip6_src = sc->sc_dst.sin6.sin6_addr; 3361 ip6->ip6_nxt = IPPROTO_TCP; 3362 /* ip6_plen will be updated in ip6_output() */ 3363 th = (struct tcphdr *)(ip6 + 1); 3364 th->th_dport = sc->sc_src.sin6.sin6_port; 3365 th->th_sport = sc->sc_dst.sin6.sin6_port; 3366 break; 3367 #endif 3368 default: 3369 th = NULL; 3370 } 3371 3372 th->th_seq = htonl(sc->sc_iss); 3373 th->th_ack = htonl(sc->sc_irs + 1); 3374 th->th_off = (sizeof(struct tcphdr) + optlen) >> 2; 3375 th->th_flags = TH_SYN|TH_ACK; 3376 th->th_win = htons(sc->sc_win); 3377 /* th_sum already 0 */ 3378 /* th_urp already 0 */ 3379 3380 /* Tack on the TCP options. */ 3381 optp = (u_int8_t *)(th + 1); 3382 *optp++ = TCPOPT_MAXSEG; 3383 *optp++ = 4; 3384 *optp++ = (sc->sc_ourmaxseg >> 8) & 0xff; 3385 *optp++ = sc->sc_ourmaxseg & 0xff; 3386 3387 if (sc->sc_request_r_scale != 15) { 3388 *((u_int32_t *)optp) = htonl(TCPOPT_NOP << 24 | 3389 TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 | 3390 sc->sc_request_r_scale); 3391 optp += 4; 3392 } 3393 3394 if (sc->sc_flags & SCF_TIMESTAMP) { 3395 u_int32_t *lp = (u_int32_t *)(optp); 3396 /* Form timestamp option as shown in appendix A of RFC 1323. */ 3397 *lp++ = htonl(TCPOPT_TSTAMP_HDR); 3398 *lp++ = htonl(tcp_now); 3399 *lp = htonl(sc->sc_timestamp); 3400 optp += TCPOLEN_TSTAMP_APPA; 3401 } 3402 3403 /* Compute the packet's checksum. */ 3404 switch (sc->sc_src.sa.sa_family) { 3405 case AF_INET: 3406 ip->ip_len = htons(tlen - hlen); 3407 th->th_sum = 0; 3408 th->th_sum = in_cksum(m, tlen); 3409 break; 3410 #ifdef INET6 3411 case AF_INET6: 3412 ip6->ip6_plen = htons(tlen - hlen); 3413 th->th_sum = 0; 3414 th->th_sum = in6_cksum(m, IPPROTO_TCP, hlen, tlen - hlen); 3415 break; 3416 #endif 3417 } 3418 3419 /* 3420 * Fill in some straggling IP bits. Note the stack expects 3421 * ip_len to be in host order, for convenience. 3422 */ 3423 switch (sc->sc_src.sa.sa_family) { 3424 case AF_INET: 3425 ip->ip_len = tlen; 3426 ip->ip_ttl = ip_defttl; 3427 /* XXX tos? */ 3428 break; 3429 #ifdef INET6 3430 case AF_INET6: 3431 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 3432 ip6->ip6_vfc |= IPV6_VERSION; 3433 ip6->ip6_plen = htons(tlen - hlen); 3434 /* ip6_hlim will be initialized afterwards */ 3435 /* XXX flowlabel? */ 3436 break; 3437 #endif 3438 } 3439 3440 /* 3441 * If we're doing Path MTU discovery, we need to set DF unless 3442 * the route's MTU is locked. If we don't yet know the route, 3443 * look it up now. We will copy this reference to the inpcb 3444 * when we finish creating the connection. 3445 */ 3446 if ((rt = ro->ro_rt) == NULL || (rt->rt_flags & RTF_UP) == 0) { 3447 if (ro->ro_rt != NULL) { 3448 RTFREE(ro->ro_rt); 3449 ro->ro_rt = NULL; 3450 } 3451 bcopy(&sc->sc_src, &ro->ro_dst, sc->sc_src.sa.sa_len); 3452 rtalloc(ro); 3453 if ((rt = ro->ro_rt) == NULL) { 3454 m_freem(m); 3455 switch (sc->sc_src.sa.sa_family) { 3456 case AF_INET: 3457 ipstat.ips_noroute++; 3458 break; 3459 #ifdef INET6 3460 case AF_INET6: 3461 ip6stat.ip6s_noroute++; 3462 break; 3463 #endif 3464 } 3465 return (EHOSTUNREACH); 3466 } 3467 } 3468 3469 switch (sc->sc_src.sa.sa_family) { 3470 case AF_INET: 3471 if (ip_mtudisc != 0 && (rt->rt_rmx.rmx_locks & RTV_MTU) == 0) 3472 ip->ip_off |= IP_DF; 3473 3474 /* ...and send it off! */ 3475 error = ip_output(m, sc->sc_ipopts, ro, 0, NULL); 3476 break; 3477 #ifdef INET6 3478 case AF_INET6: 3479 ip6->ip6_hlim = in6_selecthlim(NULL, 3480 ro->ro_rt ? ro->ro_rt->rt_ifp : NULL); 3481 3482 error = ip6_output(m, NULL /*XXX*/, (struct route_in6 *)ro, 3483 0, NULL, NULL); 3484 break; 3485 #endif 3486 default: 3487 error = EAFNOSUPPORT; 3488 break; 3489 } 3490 return (error); 3491 } 3492
Indexes created Tue Sep 23 07:09:52 GMT 2025